55
Bring Licensed Threat Intelligence into Every Conversation with SOCRadar and ChatGPT
SOCRadar launched a Threat Intelligence MCP app connecting ChatGPT to its licensed threat intelligence via OAuth-authenticated MCP server.
SOCRadar announced a Threat Intelligence MCP app that connects ChatGPT to the SOCRadar MCP server over OAuth. The integration exposes the vendor's licensed intelligence models directly in ChatGPT conversations. The announcement is a vendor product launch with no incident or vulnerability content.
22
12 Best Enterprise Browsers Compared (2026): Features & Pricing
2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.
Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.
12
Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026
2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.
Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.
12
30
30
30
42
30
Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI
Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.
Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.
35
30
55
30
30
Top 10 Best AWS Security Tools in 2026
Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.
The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.
15
Top 10 Best Multi-Cloud Security Platforms in 2026
An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).
The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.
15
ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response
ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.
ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.
25
Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026
2026 CIEM guide ranks Wiz, Prisma Cloud, Okta, Entra Permissions Management and specialists Sonrai, Britive, Tenable/Ermetic for cloud entitlement right-sizing.
Buyer's guide covers ten CIEM products across three market routes: CNAPP-bundled (Wiz, Prisma Cloud), identity-suite (Okta, CyberArk, SailPoint, Saviynt) and specialists (Sonrai, Britive, Tenable/Ermetic). It cites machine identities outnumbering humans 10:1 plus effective-permissions sprawl as core drivers, with JIT elevation as the fix. Notable consolidation includes Tenable acquiring Ermetic and Zscaler acquiring Canonic.
12
12 Best Browser Isolation Solutions Compared (2026): Features & Pricing
2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.
Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.
12
Product showcase: mSecure makes one vault do more than remember passwords
Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.
mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.
12
Superna 2.15 simplifies cyberstorage security and resilience operations
Superna released Cyberstorage platform v2.15 with redesigned ransomware investigation, guided incident closure and disaster recovery workflows.
Superna announced version 2.15 of its Cyberstorage platform, redesigning the user experience across security and resilience operations. The update adds centralized alarm management with severity and device filtering, consolidated threat investigation views showing affected data, snapshots, recovery status and impacted assets, and guided incident classification and closure workflows. It also refreshes Security Guard healthchecks, audit reporting, disaster recovery workflows and Enterprise AirGap isolation across the Data Security and Disaster Recovery editions.
22
Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.
14
Vali Cyber ZeroLock 5 brings MFA to the hypervisor command line
Vali Cyber released ZeroLock 5 adding CLI-MFA to protect VMware ESX and Linux hypervisors from insider threats and stolen credentials.
ZeroLock 5 introduces CLI-MFA, requiring time-based one-time passwords for file access, program execution, and network operations at the hypervisor command line on ESX and Linux hosts. The release targets ransomware and nation-state actor pivots to virtualization infrastructure, exemplified by ShinyHunters' shinysp1d3r RaaS platform that encrypts VMware ESX environments using stolen credentials and SSH keys. It adds remotely deployable collectors, reusable multi-site deployment blueprints, SIEM forwarding presets, and support for VCF and ESX 6.7+.
27
Hottest cybersecurity open-source tools of the month: August 2026
August's open-source security roundup highlights NVIDIA SkillSpector for AI agent skill scanning, Future AGI, Chainloop, PentestGPT, and Hazmat agent containment.
Help Net Security's August 2026 roundup covers five open-source tools: NVIDIA's SkillSpector, a scanner that assesses AI agent skills from directories, zips, SKILL.md files, or Git URLs and returns findings and risk scores; Future AGI, an Apache 2.0 platform for tracing, evaluating, simulating, and guardrailing LLM agents; Chainloop, a software supply chain evidence store that produces signed in-toto attestations in CI pipelines; PentestGPT, an agentic penetration testing framework running recon, exploit, and reporting stages; and Hazmat, which runs AI coding agents like Claude Code and Codex inside a separate machine account for containment.
25
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.
58
30
30
55
55
30
42
30
30
42
30
30
30
30
30
30