Introducing AlertZero: Inbox zero for your alert queue
AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your priorities. Nothing changes in your en...
research
20 articles
Japan Adopts Proactive Cyber Defense Strategy
Learn about Japan's Active Cyber Defense (ACD) strategy, mandatory reporting rules, and key impacts on critical infrastructure.
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolutio...
Inside a brand deal scam targeting YouTube creators
A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account
The model isn't cooperating
Have you ever felt like a model isn't actually trying to do what you asked? Did you just ask it wrong, or is there something else at play here?
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The p...
The quest for simplicity: Why SMBs want advanced protection without the complexity
The cybersecurity market is often making it tougher for SMBs to keep threats at bay
How to fix a bug in a fix
Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure. Some v...
Smashing the token limit with overlapping fragments
I'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader.
5th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 5th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Arizona’...
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules across noise, performance, threat, and p...
SequenceHash: multihashing for the rest of us
Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling poi...
This month in security with Tony Anscombe – September 2026 edition
Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace
OperTraitors: How Kubernetes Operators Betray Your Security Posture
We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities. The post OperTr...
Timeshare exit scams: From fake buyers to recovery fraud
Con artists are targeting timeshare owners who want out – and some victims are hit twice
Social Engineering in the Age of Synthetic Media
How AI Changes Phishing, Impersonation, and Identity Verification
No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current
Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Codex config onto new laptops without pi...
Recorded Future Debuts Autonomous Defense, Built for Machine-Speed Threats
Recorded Future just revealed autonomous defense capabilities. The platform hunts, investigates, and stops threats on its own, acting on real intelligence.
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild.
28th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The F...