55
30
Wazuh and AI For Enhanced SOC Workflows
Wazuh details AI-powered SOC workflows via its AI Analyst, self-hosted Llama 3 via Ollama, and Claude 3.5 Haiku integrations.
Wazuh outlines how AI can augment SOC analysts handling high alert volumes. The Wazuh AI Analyst on Wazuh Cloud uses Amazon Bedrock and Anthropic Claude to generate scheduled security posture reports. Self-hosted options include Llama 3 with Ollama, FAISS, and LangChain for privacy-sensitive threat hunting, plus an OpenSearch Assistant integration with Claude 3.5 Haiku. This is a vendor-contributed piece describing product capabilities rather than an incident or vulnerability.
25
30
30
30
30
55
42
30
Product showcase: Doppler secures secrets for humans, pipelines, and AI agents
Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.
Doppler stores API keys, database URLs, tokens, and certificates in a single control plane and injects them at runtime, replacing .env files for human and machine identities including AI agents. It supports OIDC with short-lived identity tokens for Azure, AWS, and GCP, dynamic secrets scoped and time-boxed to single sessions, SCIM provisioning, 50+ integrations, and an MCP server that lets agents request configurations natively. Permissions are enforced at each layer so raw secrets stay out of logs, prompts, and model context, with versioning, rollback, SIEM log forwarding, and cloud or on-prem deployment.
26
Automox Mitigation Worklets cut endpoint exposure to unpatchable flaws
Automox launched an AI-speed Mitigation Worklet Pipeline that drafts and publishes mitigations for unpatchable vulnerabilities within hours of disclosure.
Automox announced its Mitigation Worklet Pipeline, which uses AI to draft mitigations for unpatchable vulnerabilities and publishes human-reviewed Worklets to its catalog within hours of disclosure. The company cites rising vulnerability volume, including a record Patch Tuesday with 973 CVEs, as motivation. Customers can search Worklets by CVE, control deployment targets, and verify execution through Activity Logs and Policy Results.
35
55
AI SIEM Search
Huntress launched AI Search for Managed SIEM, translating plain-English questions into ESQL log queries with schedulable custom alerts.
Huntress introduced AI Search in its Managed SIEM, letting users query logs in natural language instead of writing ESQL, KQL, or SPL. The feature generates a real ESQL query behind the scenes, exposes it for users to inspect and learn from, and allows saved searches to be scheduled as recurring alerts at hourly, daily, or weekly cadence. A planned next version will return summarized plain-language answers instead of raw logs.
22
30
30
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.
Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.
50
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI
Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.
35
30
30
Top 10 Best AWS Security Tools in 2026
Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.
The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.
15
Hillingar - MirageOS Unikernels on NixOS
A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.
This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.
25
55
Exaforce extends its AI security tool to monitor more than just Claude
Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.
Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.
22
42
42
30
Bulk AbuseIPDB reporting using command-line tools
A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.
The author's self-hosted Gitea instance was scraped by distributed bots using random IPs worldwide and randomized, often nonexistent User-Agent strings, generating heavy request load for days. The write-up demonstrates filtering Traefik access logs (CLF and JSON) with grep, awk, and jq to extract offending IPs, tagging them with AbuseIPDB category 19 (Bad Web Bot), deduplicating them, and building a CSV for the Bulk Reporter tool. Reports can then be submitted through the AbuseIPDB bulk-report API, respecting the 5,000-report daily limit.
12
30
Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping
Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.
Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.
52
30