30
60
Recorded Future Launches AI Alert Filtering
Recorded Future launched AI Alert Filtering to automatically triage threat intelligence alerts by relevance, letting analysts prioritize faster while retaining control.
Recorded Future announced general availability of AI Alert Filtering, powered by Recorded Future AI. The feature automates the first pass of filtering alerts by relevance so analysts can prioritize faster while keeping human control. It applies LLM-based automation to threat intelligence alert triage workflows.
25
57
Recorded Future Launches Impact and Metrics Dashboard
Recorded Future releases an Impact and Metrics Dashboard aggregating risk-reduction, detection, and analyst-efficiency metrics for customer leadership reporting.
The dashboard pulls data from a customer's environment, alerts, integrations, threat detections, and analyst activity into six metric areas: platform-wide security value, threat prioritization, threat detection, digital risk protection, account and credential monitoring, and Recorded Future AI and Insikt Group research usage. It is available now to all Recorded Future customers, who are advised to configure Priority Intelligence Requirements in Settings so reporting maps to their intelligence program. The vendor cites its 2025 ROI Report across nearly 300 customers reporting 351.3% annual ROI and says customers aligning alerting to PIRs identified new threats 65% faster.
28
50
60
57
Mines, Minds, and Machines: The Journey of AI
Recorded Future essay traces AI's supply chain from minerals and chips to embodied AI, mapping geopolitical rivalry and cyber operations at every stage.
Recorded Future published an analysis following the supply chain of the fourth industrial revolution: minerals become chips, chips become data centers, and data centers become models that are acquiring physical capabilities. It argues geopolitical rivalry and cyber operations now run along every link, from mine to embodied AI machines.
15
60
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.
55
55
30
60
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.
78
60
55
30
30
60
60
60
60
42
55
30
45
57
60
60
60
60
The Intelligible World of Agents
Recorded Future argues cybersecurity AI agents perform better when reasoning over structured, curated intelligence graphs rather than fragmented alerts or open-source noise.
In a vendor essay, Recorded Future describes how its security agents produced more authoritative analyses after being re-architected to reason primarily over the Recorded Future Intelligence Graph instead of weighting open-source information equally. The author argues agentic decision quality depends mainly on a structured, current operational world model of assets, vulnerabilities, threat actors, detections and organizational context, not on model intelligence itself. The piece further claims frontier model access is commoditizing and that orchestration tooling will converge, making trusted representations of organizational knowledge the durable competitive differentiator.
20
30
60
The Agentic SOC – From AI Theater to Real Defense
Recorded Future and Accenture experts outline how security teams can move beyond 'AI theater' toward agentic SOC operations guided by measurable KPIs.
Recorded Future published a blog featuring perspectives from its own and Accenture experts on building an agentic security operations center. The piece argues organizations should prioritize measurable KPIs and proactively mitigate risks from autonomous agents. It also discusses evolving the analyst role from managing alerts to managing agents.
18
60
CopyCop Targets AI Investment in Armenia
Recorded Future reports the Russian influence network CopyCop is targeting Western-backed AI and infrastructure projects in Armenia.
According to Recorded Future, the Russian influence network CopyCop is running a campaign against Western-backed AI and infrastructure initiatives in Armenia. Targets include the Firebird AI data center. The apparent goal is to undermine Armenia's westward geopolitical realignment by discrediting these projects.
48
55
Why The Vulnerability Backlog Is About To Get Worse
Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.
Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.
45