ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “methodology”

3 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 1Industry 1Research 1
SeverityAllcritical 0high 0medium 0low 1info 2

Adversary simulation: what you need to know

UK NCSC publishes guidance on adversary simulation, comparing full spectrum and assumed breach approaches across prerequisites, testing, and reporting phases.

NCSC guidance describes two adversary simulation approaches: full spectrum, starting outside the network with an end-to-end attack, and assumed breach, starting from an internal foothold. The preferred methodology spans three phases - prerequisites (scoping, passive reconnaissance, preparation), testing (active reconnaissance, initial access, internal phase, cleanup), and reporting. The document distinguishes adversary simulation from penetration testing and stresses customer-defined objectives and minimal information sharing.

NCSC UKupdated · 2h agofirst · 3h agoAdvisory 2 sources

German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints

Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.

ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.

Cyber Security Newsupdated · 3h agofirst · 20h agoIndustry 3 sources

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 22h agoResearch