30
30
30
30
42
30
30
55
55
30
55
30
55
55
30
30
Axoflow Launches AxoDetect, Bringing Detection Into the Pipeline and Making the SIEM Optional
Axoflow launches AxoDetect in early access, running customer Sigma rules in the data pipeline to cut SIEM ingest costs and make full SIEM feeding optional.
Axoflow announced AxoDetect, now in early access and unveiled at Splunk .conf26, which runs customer Sigma rules directly in the security data pipeline on normalized data. Alerts travel to the SIEM while full-fidelity logs land in AxoLake, a low-cost on-prem-capable security data lake. The company cites a global industrial company cutting SIEM costs 50% and mean time to resolution 85%, and a government agency cutting data volume 80%.
22
Nozomi Compass helps industrial teams manage OT assets and vulnerabilities
Nozomi Networks launched Compass, an OT asset and vulnerability management platform unifying asset records, remediation workflows, and compliance evidence for industrial teams.
Nozomi Networks announced Compass, an OT asset and service management platform built on real-time first-party asset data from its Vantage cyber-physical security platform. It provides OT-native workflows, governed change approvals, consequence-based risk scoring, and continuous audit-ready compliance evidence mapped to NERC CIP, IEC 62443, NIS2, and TSA. The platform integrates with EAM, CMDB, ITAM, ITSM, SIEM, and SOAR tools and is designed to safely support AI-driven and agentic OT workflows with human oversight.
35
Top 10 Best AWS Security Tools in 2026
Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.
The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.
15
Top 10 Best Multi-Cloud Security Platforms in 2026
An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).
The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.
15
F5 Bot Defense uses real-time risk scoring to detect fraud and abuse
F5 enhances Distributed Cloud Bot Defense with persistent device identification, real-time risk scoring, and agent-aware policies to manage AI agent traffic.
F5 announced enhancements to Distributed Cloud Bot Defense adding persistent device identification, real-time device risk scoring, risk-based workflow enforcement, and an agent-aware policy framework integrated with the F5 Application Delivery and Security Platform. The features aim to expose multi-account abuse, credential stuffing, and account takeover while allowing trusted AI agents to transact at machine speed. It targets fraud and abuse detection as agentic AI becomes a key interaction channel for sites, apps, and APIs.
22
Give every teammate and agent the right level of access to your Workers
Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.
Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.
22
Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point
Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.
Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.
18
Top 10 Best Container Security Tools in 2026
2026 roundup ranks Aqua, Sysdig, Prisma Cloud, Wiz, Snyk and CrowdStrike among the ten best container security tools across build-ship-run.
Buyer's guide compares ten container security products by lifecycle fit: Aqua leads full lifecycle, Sysdig leads runtime detection via Falco and eBPF, Wiz offers agentless graph visibility, Snyk covers developer-first shift-left. It notes Trivy and Falco as free production-grade open-source foundations. The guide argues standalone container security is increasingly absorbed into CNAPP platforms from Palo Alto, Wiz and CrowdStrike.
12
12 Best Enterprise Browsers Compared (2026): Features & Pricing
2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.
Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.
12
OpenSSL 4.1.0 Alpha1 Released With DTLS 1.3 and Faster Post-Quantum Cryptography
OpenSSL 4.1.0 Alpha1 adds DTLS 1.3 support, ML-DSA and ML-KEM post-quantum optimizations, and GREASE TLS compatibility, intended for testing only.
The alpha preview of OpenSSL 4.1.0 implements RFC 9147 DTLS 1.3 for UDP-based applications and integrates DTLS into the SSL listener API. It accelerates ML-DSA signatures and ML-KEM encapsulation with AVX-512 and VAES optimizations on x86_64, and adds GREASE (RFC 8701), IKEv2 KDF support, and Elbrus2000 (e2k) targets. The release is intended for testing and development, not production, and removes Windows-on-Itanium and Windows CE build targets.
22
OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities
OpenAI unveils a Defense Factory where AI agents continuously discover, validate, and fix vulnerabilities, integrating GitHub, Snyk, Semgrep, Tenable, and ServiceNow.
OpenAI introduced a Defense Factory, an agent-first cybersecurity operation that connects AI agents to developer and security tools via APIs, CLIs, and Model Context Protocol integrations including GitHub, GitLab, Snyk, Semgrep, Tenable, Jira, Linear, and ServiceNow. During an internal security sprint, over 250 people across more than 100 service areas closed 53 urgent or high-priority issues on day one, achieved a 90.6% accepted ownership-assignment rate, and Codex generated all remediation patches with only 0.53% rolled back. Agent-assisted deduplication flagged 37% of findings as duplicates, and runtime validation reproduced 19.5% of findings, cutting the false-positive rate to 0.81%. OpenAI argues defenders must exploit a temporary 'defender's window' using source-code access and frontier models before open-weight models enable autonomous offensive agent fleets.
55
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.
GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.
22
Akeyless adds real-time enforcement for AI agents in production
Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore
Akeyless announced general availability of Agentic Runtime Authority, a real-time identity control layer that evaluates AI agent actions and blocks policy-violating actions before execution, layered on top of its SecretlessAI credential brokering. New integrations cover Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore, alongside an Agentic Access Dashboard with session kill switches and event forwarding to Splunk, Datadog and Microsoft Sentinel. The vendor's platform already secures over 220 billion machine identity interactions for Fortune 500 organizations.
32
Zscaler Agentic SOC combines AI agents with zero trust telemetry
Zscaler launched Agentic SOC, an AI-agent-driven security operations platform combining zero trust telemetry with frontier models from Anthropic and OpenAI.
Zscaler announced Agentic SOC, a security operations platform built around specialized AI agents for triage, root-cause investigation, verdict assignment, and automated threat containment. The platform pairs Zscaler's zero trust telemetry, drawn from roughly 750 billion daily transactions and a large decoy mesh network, with frontier models from Anthropic and OpenAI plus proprietary threat intelligence. It features closed-loop inline remediation that can isolate compromised users, block command-and-control traffic, and cut off lateral movement, alongside a context graph that correlates third-party data. Continuous threat hunting combines AI automation with human experts from Zscaler and Red Canary, and customer Maire Tecnimont is cited as an early adopter.
32
Claude Mythos 5 is coming to Tenable One, powering the new “Adversary View”
Tenable will integrate Anthropic's Claude Mythos 5 into Tenable One, launching Adversary View to surface exploitable vulnerability chains from scan data.
Tenable announced it is bringing Anthropic's Claude Mythos 5 into the Tenable One Exposure Management Platform, extending its Project Glasswing research work with Anthropic. The first capability, Tenable One Adversary View, will use the model's adversarial reasoning over raw scanner evidence, plugin output, live connections and low-confidence signals to identify viable vulnerability chains and ranked defensive actions. Customers will act on results through Tenable Hexa AI. Availability details for Adversary View are expected in the coming weeks; no customer deployment exists yet.
35
Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.
22
Mars Security brings threat intelligence to detection in real time
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.
24
Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes
Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.
The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.
24
Product showcase: Doppler secures secrets for humans, pipelines, and AI agents
Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.
Doppler stores API keys, database URLs, tokens, and certificates in a single control plane and injects them at runtime, replacing .env files for human and machine identities including AI agents. It supports OIDC with short-lived identity tokens for Azure, AWS, and GCP, dynamic secrets scoped and time-boxed to single sessions, SCIM provisioning, 50+ integrations, and an MCP server that lets agents request configurations natively. Permissions are enforced at each layer so raw secrets stay out of logs, prompts, and model context, with versioning, rollback, SIEM log forwarding, and cloud or on-prem deployment.
26
AI SIEM Search
Huntress launched AI Search for Managed SIEM, translating plain-English questions into ESQL log queries with schedulable custom alerts.
Huntress introduced AI Search in its Managed SIEM, letting users query logs in natural language instead of writing ESQL, KQL, or SPL. The feature generates a real ESQL query behind the scenes, exposes it for users to inspect and learn from, and allows saved searches to be scheduled as recurring alerts at hourly, daily, or weekly cadence. A planned next version will return summarized plain-language answers instead of raw logs.
22
Hillingar - MirageOS Unikernels on NixOS
A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.
This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.
25
Synology ActiveProtect Manager 2.0 improves AI-driven security
Synology released ActiveProtect Manager 2.0, expanding backup coverage to EC2, Azure, Proxmox and Google Workspace, with AI anomaly detection and malware scanning coming in 2.1.
Synology launched ActiveProtect Manager 2.0 for its DP Series data protection appliances, adding platform coverage for Amazon EC2, Azure VM, Proxmox VE, Nutanix AHV and Google Workspace. The release introduces cross-platform recovery, expanded backup destinations including Azure Blob Storage, and volume-level software storage encryption. The upcoming 2.1 update will add AI/ML anomaly detection tracking change rates, mass deletions and entropy, plus pre-restore malware scanning using Microsoft Defender, Bitdefender and ESET with Auto Fallback to the last clean version.
25
Superna 2.15 simplifies cyberstorage security and resilience operations
Superna released Cyberstorage platform v2.15 with redesigned ransomware investigation, guided incident closure and disaster recovery workflows.
Superna announced version 2.15 of its Cyberstorage platform, redesigning the user experience across security and resilience operations. The update adds centralized alarm management with severity and device filtering, consolidated threat investigation views showing affected data, snapshots, recovery status and impacted assets, and guided incident classification and closure workflows. It also refreshes Security Guard healthchecks, audit reporting, disaster recovery workflows and Enterprise AirGap isolation across the Data Security and Disaster Recovery editions.
22
Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira
Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.
Stratus Security released Sift, a free open-source command line tool that hunts passwords, API keys, and sensitive data across local disks, Windows shares, Active Directory, SharePoint, OneDrive, Teams, Slack, Jira, and Confluence. In the firm's benchmarks, Sift scanned 250,000 files in 10.61 seconds versus Snaffler's 25.48 and averaged 92 MiB memory versus Snaffler's 337 MiB. Optional false-positive filtering runs through a local language model via Ollama, and scans write checkpoints so interrupted runs resume. The tool found thousands of credentials in Jira ticket comments that prior pentesting had missed.
28