Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.
Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes
Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.
The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.
Mars Security brings threat intelligence to detection in real time
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.
UltraViolet Cyber Equinox measures detection coverage against MITRE frameworks
UltraViolet Cyber launches Equinox, an AI-automated platform mapping SIEM and EDR detection coverage against MITRE ATT&CK and ATLAS frameworks.
UltraViolet Cyber announced Equinox, a detection engineering platform from its TIDE team that maps existing detections and log sources against MITRE ATT&CK and MITRE ATLAS. It performs coverage analysis in under 30 minutes and recommends vendor or custom detections to fill gaps, with engineers reviewing and backtesting each recommendation. In one customer trial, mapped technique coverage rose from 59 of 222 techniques (26.6%) to 136 of 222 (61.3%) without increasing alert volume.
Cohesity adds recovery capabilities for AI agents and the data they manage
Cohesity launched Agent Resilience to discover, protect, and recover AI agent memory, configuration, and agent-managed data, debuting with Amazon Bedrock integration.
At Cohesity Catalyst, Cohesity introduced Agent Resilience within Cohesity Data Cloud, protecting AI agent memory and configuration with snapshot architecture, immutable backups, and clean-room recovery, plus recovery for databases and file systems that agents manage. It launches with Amazon Bedrock integration, support for Microsoft and Google platforms planned, and general availability targeted for year-end. The company cited Gartner's prediction that up to 40% of enterprise applications will include task-specific agents by 2026, and Cohesity research showing 56% of organizations are unprepared to detect or contain unintended agent actions while 58% lack confidence in verifying AI model integrity after attacks. Cohesity also outlined an Autonomous Cyber Resilience vision using agentic workflows and introduced the AI Resilience Academy.
Axoflow Launches AxoDetect, Bringing Detection Into the Pipeline and Making the SIEM Optional
Axoflow launches AxoDetect in early access, running customer Sigma rules in the data pipeline to cut SIEM ingest costs and make full SIEM feeding optional.
Axoflow announced AxoDetect, now in early access and unveiled at Splunk .conf26, which runs customer Sigma rules directly in the security data pipeline on normalized data. Alerts travel to the SIEM while full-fidelity logs land in AxoLake, a low-cost on-prem-capable security data lake. The company cites a global industrial company cutting SIEM costs 50% and mean time to resolution 85%, and a government agency cutting data volume 80%.
12 Best Browser Isolation Solutions Compared (2026): Features & Pricing
2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.
Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.