Search: “vendor-comparison”

Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program

SE Labs launched PIVOT, a six-month vendor detection testing program backed by CrowdStrike, Fortinet, Palo Alto Networks and Sophos, as major vendors exit MITRE evaluations.

SE Labs unveiled PIVOT on September 15, a six-month testing program in which its ethical hackers replicate nation-state and criminal attack chains against participating vendor products, with results due January 2027. Broadcom (Symantec/Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks and Sophos have confirmed participation, and Gartner and Forrester analysts will verify the underlying evidence before publication. The launch follows declining participation in MITRE Engenuity ATT&CK Evaluations: Enterprise, which fell from 30 vendors in 2023 to 11 in 2025 after public withdrawals by Microsoft, SentinelOne and Palo Alto Networks.

Infosecurity Magazine·updated 08:33 UTC · 2h ago·first Sep 16, 09:00 UTC · 1d agoIndustry 12 sources

A Zeroth-Order Paradigm for LLM Preference Alignment

ComPO is a zeroth-order preference alignment method using comparison oracles to mitigate likelihood displacement across Mistral, Llama, Gemma, and Qwen3 models.

The paper proposes Comparison-based Preference Optimization (ComPO), a zeroth-order alignment method that extracts directional information from preference pairs with small likelihood margins without directly optimizing a differentiable preference loss. The authors prove convergence guarantees for the offline scheme and performance guarantees for a constrained online variant with reverse-KL control. Experiments on Mistral, Llama, Gemma-2, Qwen3, and Gemma-3 show improvements over existing direct alignment methods, including length-controlled win rates, with pair-level diagnostics consistent with mitigating likelihood displacement.

Hugging Face daily papers·updated Sep 16, 17:59 UTC · 16h ago·first Sep 15, 20:00 UTC · 1d agoAI research 2 sources

The 12 Best Managed XDR Services, Compared and Priced

A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.

The article compares twelve managed XDR providers including Bitdefender, CrowdStrike, Palo Alto Unit 42, Trend Micro, Fortinet, Secureworks Taegis, Stellar Cyber, Ontinue, and ReliaQuest, highlighting pricing models and telemetry breadth. It explains that genuine MXDR must actively monitor identity, cloud, and email telemetry rather than merely ingest it, and typically costs 30-60% more than endpoint-only MDR. It also notes Sophos completed its approximately $859 million acquisition of Secureworks in February 2025.

GBHackers·Sep 9, 08:07 UTC · 8d agoIndustry 3 sources2

What Does an LLM-Agent Leaderboard Rank Actually Compare?

A methodological study shows close LLM-agent leaderboard rank gaps on SWE-bench and similar benchmarks often do not support superiority claims.

The paper defines an estimand-aware pairwise procedure for comparing agents, checking common support and applying explicit uncertainty rules and practical margins. Across SWE-bench, AgentRewardBench, and tau2-bench, close rank differences are frequently unresolved, and proxy labels or utility rules can change which system is selected. The authors argue a leaderboard score summarizes a released evaluation but does not by itself justify pairwise superiority conclusions.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:31 UTC · 9d agoAI research

Managed EDR: What It Is & How to Choose a Provider

Huntress outlines differences between managed and unmanaged EDR and offers guidance on evaluating managed detection and response providers.

The Huntress blog explains how EDR provides endpoint visibility, detection, and response, and contrasts self-managed EDR with vendor- or MSP-delivered managed EDR. It notes unmanaged deployments require in-house staffing to tune and triage high alert volumes, while managed EDR supplies expert investigation and reduced alert fatigue at the cost of less control and third-party visibility. The post lists questions for evaluating providers, including analyst training, monitoring and investigation processes, and false-positive handling.

Huntress·Sep 3, 21:22 UTC · 13d agoIndustry

The Collective Cyber Defense letter wrote your next vendor questionnaire

Op-ed argues the 200-company Collective Cyber Defense letter's three endorsed metrics should become standard vendor procurement questions.

More than 200 companies including Microsoft, Google, AWS, CrowdStrike, Anthropic and Okta signed an August 27 open letter calling for faster cyber defenses against AI-enabled attacks. The letter endorses three measurable metrics: coverage, containment speed, and verified remediation. The author turns those into five concrete procurement questions buyers should pose at vendor renewals, while noting the letter contains no deadlines, dollar figures or measurable targets.

CyberScoop·Sep 1, 10:00 UTC · 16d agoIndustry

12 Best CIEM Tools Compared (2026): Features & Pricing

Buyer's guide compares twelve CIEM tools; Microsoft discontinued Entra Permissions Management, while Tenable (Ermetic), CyberArk, and Wiz lead the 2026 scorecard.

The scorecard evaluates twelve cloud infrastructure entitlement management vendors on permission analytics depth, JIT enforcement, non-human identity coverage, pricing predictability, and bundle leverage. Tenable (Ermetic) leads at 4.70, followed by CyberArk and Wiz, while Microsoft's retirement of Entra Permissions Management (CloudKnox) forces existing customers into migration cycles. Pricing structures span per-identity, per-resource, per-workload, credit-based, and quote-based models.

GBHackers·updated 10:33 UTC · 17m ago·first Sep 16, 07:37 UTC · 1d agoIndustry 3 sources

Distill Globally, Adapt Locally: Reasoning Distillation and Product-Type Test-Time Training for Scalable Trade-Up Recommendation

A distillation framework compresses LLM reasoning into a 15.5M-parameter trade-up recommendation model reaching AUC 0.941 with product-type test-time training.

The paper targets trade-up recommendation, which identifies higher-quality alternatives that preserve customer purchase intent. A retrieval-augmented few-shot LLM teacher generates labels and rationales that supervise a compact embedding-pair classifier; at inference the 15.5M-parameter student uses only two precomputed 768-dimensional embeddings with no LLM calls. On 8,352 annotated pairs, label-only training scored AUC 0.912, reasoning distillation reached 0.924, and product-type test-time training lifted it to 0.941 with average precision 0.940. The distilled student is roughly 5,000x faster and 10,000x cheaper than direct LLM inference on a 100K-pair proxy catalog.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 17:08 UTC · 12d agoAI research

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.

VEX-Bench is the first benchmark evaluating LLM agents on assessing whether upstream dependency vulnerabilities are exploitable in downstream projects, with 75 real-world expert-labeled cases across Python, Java, and Go mined from GitHub. Nine models across three agent harnesses were evaluated; GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, but only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification. The gap highlights the difficulty of moving beyond binary exploitability calls to explaining exploitability reasons, unlike prior benchmarks targeting zero-day settings.

arXiv cs.CR·Sep 7, 22:52 UTC · 9d agoResearch1

Product showcase: Trust Chain TPRM turns vendor compliance evidence into verified assurance

Help Net Security·Aug 10, 12:30 UTC · Aug 10, 2026Policy & legal

Top 10 Best Data Security Posture Management (DSPM) Tools in 2026

A 2026 scorecard ranks DSPM tools with Wiz and Cyera tied first, documenting consolidation via Palo Alto, Rubrik, Proofpoint, and CrowdStrike acquisitions.

The article ranks ten DSPM platforms: Wiz and Cyera tie at 8.7/10, followed by BigID at 8.5 and Securiti at 8.4, scored on discovery breadth, classification accuracy, access context, remediation, and value. It highlights heavy market consolidation, noting Dig Security was acquired by Palo Alto Networks, Laminar by Rubrik, Normalyze by Proofpoint, and Flow Security by CrowdStrike. Buyers are advised to purchase from current owners and confirm post-acquisition integration state.

Cyber Security News·Sep 16, 07:29 UTC · 1d agoIndustry1

Scytale expands vendor risk management with AI-powered TPRM tools

Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.

Scytale added AI-driven TPRM capabilities to its Vendors module, combining automatic vendor discovery from SSO providers and integrations with AI enrichment and dynamic risk scoring. The platform now continuously monitors vendors for breaches, data exposures, and vulnerabilities via third-party intelligence APIs, with proactive email notifications and auto-generated audit-ready security reports. It integrates with cross-framework control mapping for SOC 2, ISO 27001, GDPR, HIPAA, and SOX ITGC. Scytale cites Verizon's 2026 DBIR, which found 48% of breaches involved a third party, up 60% year over year.

Help Net Security·Sep 10, 10:22 UTC · 7d agoTools

Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery

Architecture explainer separates agent harnesses, frameworks, and MCP by which layer owns the loop, state, permissions, and recovery.

The article distinguishes agent harnesses (OpenAI Codex, Claude Agent SDK), which own the execution loop, sandbox, permission model, and recovery; frameworks (LangGraph, OpenAI Agents SDK, Microsoft Agent Framework), which supply composable primitives; and MCP, a stateless JSON-RPC wire protocol governed by the Linux Foundation's Agentic AI Foundation since December 2025. An ownership matrix maps the execution loop, state, tool transport, permissions, recovery, sandboxing, and multi-agent orchestration to each layer. The 2026-07-28 MCP specification made the protocol fully stateless, retiring the initialize handshake and session headers.

MarkTechPost·Sep 14, 21:54 UTC · 2d agoAI research1

Performance of Clinical AI System and Physicians and Frontier Language Models in primary care diagnostics

Clinical AI system Doctorina achieved 82.0% primary-care diagnostic concordance versus 57.0% for physicians across 150 synthetic consultations.

The study compared Doctorina, eight physicians, and four standalone frontier language models on 150 synthetic Polish-language primary-care consultations. Doctorina achieved 82.0% Top-1 diagnostic concordance versus 57.0% for physicians (25.0-point difference, 95% CI 17.7-32.7) and 97.3% versus 85.0% primary-or-reference-differential concordance. Normalized workup and treatment scores were 89.4 versus 66.9 and 83.7 versus 61.2. Kimi K3 ranked next on diagnosis, while Claude Opus 5 led the closely spaced management estimates among Opus, Doctorina and Kimi.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:25 UTC · 8d agoAI research

The 12 Best Unified Endpoint Management (UEM) Solutions, Compared and Priced

A buyer's guide compares 12 unified endpoint management platforms, recommending Microsoft Intune, Jamf and Omnissa for common scenarios.

The article compares 12 UEM solutions including Microsoft Intune, Omnissa Workspace ONE, Jamf, ManageEngine, Ivanti, SOTI and 42Gears, with pricing models and platform coverage. It flags ownership changes such as Workspace ONE becoming Omnissa, BlackBerry divesting Cylance to Arctic Wolf, and Citrix's status under Cloud Software Group. Guidance centers on checking existing Microsoft 365 licensing before purchasing, per-user versus per-device pricing, and combining platforms like Intune and Jamf for Apple estates.

GBHackers·Sep 10, 08:02 UTC · 7d agoIndustry 2 sources

AI Is Ending the Era of Hidden Vulnerabilities — Are Vendors Ready?

Dark Reading argues AI-assisted bug discovery is flooding vendors with vulnerability reports, straining disclosure processes and secure-by-design commitments.

The Dark Reading analysis describes a surge of bug reports driven by AI-powered discovery, exposing bottlenecks in vendor triage and disclosure pipelines. It argues this volume is revealing secure-by-design failures and questions whether vendors can keep pace with the rising tide of findings.

Dark Reading·Sep 4, 13:00 UTC · 12d agoIndustry

[AINews] Jev: a “System One Model” that only decides/classifies/routes/scores — >100x faster, >200x cheaper than small frontier LLMs

TypeSafe launches Jev, an RLCD-trained decision model claiming 20-200x faster, 40-400x cheaper classification than frontier LLMs, alongside Gemini 3.8 Live and Neon.

TypeSafe's Jev is a 'System One' decision model trained with RLCD, claiming 20-200x faster and 40-400x cheaper classification and routing than frontier LLMs with free output tokens and no hallucinated text. Google launched Gemini 3.8 Live and 3.8 Live Extended Thinking, supporting 97 languages and async tool calls, debuting #1 on Artificial Analysis' speech-to-speech index at 82.6. Periodic Labs' Neon is a ~1T-parameter XRD analysis model trained with RL on proprietary lab data using 1,300 H200s, lifting FrontierXRD success from 2.7% to 55.3% and beating GPT-6 Astra at lower inference cost.

Latent Space·Sep 16, 11:09 UTC · 23h agoModel release1

LLM Agents as Computational Typologists

AUTOTYPOLOGIST is an LLM agent that performs evidence-grounded linguistic typology analysis over 25 open-source reference grammars.

The agent retrieves relevant grammar sections, analyzes interlinear glossed text (IGT), and iteratively reasons over typological hypotheses in a ReAct-style workflow. It was evaluated on typological feature coding against expert annotations and hypothesis testing against universals using 25 open-source reference grammars. Results suggest LLM agents can support scalable, inspectable crosslinguistic analysis but still require expert validation.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:35 UTC · 9d agoAI research1

What LLM Trading Agents Actually Do in Production: A Six-Month, Population-Scale Record from Two Fleets

Six-month record of 7.5M LLM trading agent invocations shows volatility-blind sizing, minimal upside capture, and no directional edge across two fleets.

The study records autonomous LLM trading agents in production across DX Terminal Pro (3,505 user-funded vaults trading real ETH in Base memecoin markets) and the DXAP fleet (500-599 agents on Hyperliquid perpetuals), spanning roughly six months, 7.5M single-model invocations and about 300K onchain actions. A risk slider explains leverage (+0.425 per level), median leverage is 5.0x in every volatility sextile, and one posture-slider cell holds 62% of liquidations. Agents capture little upside: 43.2% of positions saw +300 bps favorable excursion within 24h yet 49.3% of those closed negative, while the DXAP fleet trails a matched retail benchmark (41% vs 50% roundtrip win rate). A paired-replay league of frontier models finds decision quality statistically indistinguishable at this horizon.

Hugging Face daily papers·Sep 3, 20:00 UTC · 13d agoAI research

Data access: the hidden cost of security vendor lock-in

Elastic compares SIEM data egress cost, latency, and fidelity across CrowdStrike, Microsoft, Google, and Splunk, arguing vendors engineer lock-in.

Elastic Security Labs published an opinion piece comparing how major SIEM and security vendors handle data egress, based on each vendor's public documentation as of September 2026. It rates CrowdStrike Falcon Data Replicator and Palo Alto Networks XSIAM Event Forwarding as restricted (paid add-ons with batch delays), Microsoft as partially open, Splunk as open, and Elastic as open with no export license. The piece argues frictionless ingestion paired with licensed or delayed egress is an intentional lock-in business model, and cites CrowdStrike's 2026 Global Threat Report eCrime breakout time of 29 minutes to argue real-time telemetry access is now essential.

Elastic Security Labs·Sep 4, 00:00 UTC · 13d agoIndustry

Emergency Department Revisit Quality Review Screening: Exploring Human Decision-Making and Artificial Intelligence Support

A retrospective study found GPT-4 over-flagged emergency department revisit cases while an LLM knowledge-graph screener achieved 83-100% positive predictive value.

In an exploratory retrospective study of 99 emergency department diagnosis pairs from a multihospital health system, clinicians and GPT-4 independently judged whether revisit pairs warranted further assessment. GPT-4 responses correlated poorly with clinicians, flagging 94% of pairs for follow-up, 4.4-13.3 times more than clinicians, though prompt engineering was minimal. An algorithm leveraging an LLM-populated knowledge graph (KGA) achieved 83-100% positive predictive value against at least one clinician rater, suggesting LLM-based screening could broaden revisit quality review without substantially increasing reviewer workload.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:37 UTC · 7d agoAI research1

ActReview: Rebuttal-Guided Training Data and Rubric Rewards for Actionable Peer Review Generation

ActReview post-trains Qwen3-8B-Base on OpenReview rebuttals to generate actionable peer-review feedback with grounded revision suggestions, benchmarked on 1,000 curated instances.

The paper defines Actionable Peer-review Generation as diagnostic claim generation plus revision suggestion generation and introduces ActReview, a rebuttal-guided post-training framework. From OpenReview review-rebuttal threads the authors build ActReview-40K, aligning reviewer weaknesses with author responses grounded in localized paper evidence, and post-train Qwen3-8B-Base with multi-task SFT followed by GRPO using weakness-specific rubric rewards. They also release ActReview-Bench, a human-curated 1,000-instance benchmark, on which ActReview outperforms prior specialized review-generation models on actionability and grounding while remaining competitive with strong prompt-based LLMs. Human evaluation confirms improved revision usefulness but identifies a remaining gap in technical accuracy.

Hugging Face daily papers·Sep 7, 20:00 UTC · 9d agoAI research

Can LLMs Engineer Their Own Agent Harness? ByteDance Seed’s HarnessDev Says Only 34 of 64 Changes Generalize

ByteDance Seed's HarnessDev benchmark finds LLM-built agent harnesses trail human engineering on code and search, with only 34 of 64 revisions generalizing.

Researchers from ByteDance Seed, SUTD, Georgia Tech, M-A-P, and TokenWave.AI introduce HarnessDev, a benchmark that evaluates the runnable agent harness an LLM writes rather than its answers, using Creation and Evolution stages across SWE-bench Pro, Terminal-Bench 2.1, MLE-bench, EQ-Bench3, and BrowseComp (2,207 instances). Six creator models including Opus 4.8, GPT-5.5, Gemini 3.1 Pro, DeepSeek V4 Pro, Qwen 3.7 Max, and Seed 2.0 Pro were tested; Opus 4.8 posted the best average of 67.8 versus an 86.2 human-engineered reference. Self-built harnesses beat references on writing and ML experimentation but lag badly on code and search, and quality proved executor-specific: Opus 4.8 fell from 69.3 to 33.0 on SWE-bench Pro when the executor was switched to Gemini. Evolution gains were small and noisy: of 64 adjacent changes, feedback and held-out scores agreed only 34 times (53.1%), and much generated state and memory code never executed.

MarkTechPost·Sep 11, 22:01 UTC · 5d agoAI research 2 sources