Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Fool Me Once: How Cybercriminals Perfected Deception | LevelBlue Threat Trends Report (Ed. 2)

Originally recorded in 2025, we look back at how cybercriminals perfected deception during the first half of the year. Now available as an archive recording, the session highlights the second edition of the LevelBlue Threat Trends Report and explores real-world incident data, fast-moving attack chains, and the social engineering techniques that shaped the threat landscape at the time. While the data reflects early 2025, many of the lessons remain relevant for understanding how today’s threat environment evolved.

The New CISO Podcast Ep. 140 - Manuel Ressel | The Four Cs: Why a Schoolteacher Makes a Great CISO

In this episode of The New CISO, host Steve Moore speaks with Manuel "Manu" Ressel, CISO at SAUTER Group, about his unconventional journey from classroom teacher to cybersecurity leader—and why the "Four Cs" of modern education provide a powerful framework for building effective security programs. Drawing from years as both a teacher and school principal in Germany, Manu introduces Critical Thinking, Communication, Collaboration, and Creativity as essential leadership skills that fundamentally challenge how the industry approaches awareness training and incident response.

Compliance Readiness with Audit Logging

Whether pulling items together for a holiday dinner or prepping weekly meals, you need to have all the ingredients necessary to cook the meals you want to eat. Often, this means making a grocery list, checking off items as you take them from the shelves, and, possibly, grumbling when one of the items isn’t available. In the IT and business worlds, audit logging is the shopping list that helps organizations with compliance readiness.

Ep 27: 2026 Security operations insights

On this episode of Masters of Data, we dive into our 2026 Intelligent Security Operations report. While 90% of 500+ security leaders see AI/ML cutting alert fatigue, actual implementation remains stuck at basic anomaly detection—not the full automation everyone wants. The gap is real: only 51% say their SIEM effectively reduces detection and response times, exposing serious maturity issues. Add rampant tool sprawl (most orgs run 3-10+ security tools that don't communicate), and you've got an integration nightmare. We explore how Model Control Protocol and AI agents could solve this, but here's the truth.

Sumo Logic's 2026 Security Operations Insights report: AI, siloed tools, and team alignment

Security threats have always been expanding and evolving, but recent data shows that modern applications are more complex for security and operations than ever before. And AI is only a piece of that puzzle. To stay on top of the changing market and hear directly from security leaders on what’s really top of mind, Sumo Logic surveyed over 500 security leaders with the help of UserEvidence. We asked about data pipelines, tool sprawl, confidence in SIEM, and, of course, AI.

How to Ignore Cybersecurity AI Bubble FOMO

Cybersecurity teams are no longer circling an AI bubble. Rather, they are staffing inside it, buying within it, and getting measured by it. This matters because bubbles create a predictable trap: expectations are set higher than teams truly can deliver. Cato Networks CEO Shlomo Kramer recently told Business Insider the market is experiencing an AI bubble driven by heavy investment and AI-driven profit improvements, which he expects to unwind. A correction will not pause attacker activity.

UEBAenabled SIEM use cases: Stopping insider threats before they strike

Insider threats remain one of the most challenging security risks organizations face. Unlike external attackers who must breach perimeters, insiders already possess legitimate access to critical systems and data. They understand security controls, know where valuable assets reside, and can operate under the radar of traditional rule-based detection systems for extended periods.

New Databricks and Snowflake apps strengthen cloud data security and data pipeline visibility

If you’re like most companies we work with, you’re awash in opportunities (and a bit overwhelmed with pressure) to adopt AI. Of course, integrating new technologies means more data to manage and systems to monitor.

LevelBlue Threat Trends Report | Looking Back at the Key Findings Shaping Today's Security Landscape

Originally recorded in 2025, we look back at the key threat trends and attack techniques shaping the security landscape at the time. Now available as an archive recording, the session explores emerging threats, evolving attacker tactics, and early indicators of risks that still influence cybersecurity strategies today. While the data reflects 2025, many of the insights remain relevant for understanding how the modern threat landscape has evolved.

Ep 26: You can patch your code, you can't patch burnout

In this episode of Masters of Data, we tackle why cybersecurity professionals burn out, and it's not just long hours. We explore how repetitive tasks, limited growth, and work that feels invisible drain security teams who face constant vigilance with few wins and no finish line. We discuss how high-stakes environments and rigid SLAs prevent real breaks, then share solutions: celebrate small victories, recognize contributions, prioritize physical health, and protect work-life balance. The key? Clear communication, realistic expectations, and making security's invisible impact visible.
Sponsored Post

EventSentry v6: Azure Logs, HEC, Sigma, Log Signing & More

Even though the shift to the cloud has slowed recently as many businesses are moving certain workloads back on-premise, Microsoft Exchange remains one cloud-based service that most organizations continue to embrace – despite its frequent outages. This doesn’t come as a surprise, as Microsoft has successfully devolved on-prem Exchange Server – the only viable alternative – into an unfriendly dragon that even experienced sysadmins won’t touch with a 10 ft pole.

Token Torching: How I'd burn your AI budget (so you can fix it)

I spend most of my time thinking like a criminal. Not because I’m edgy, but because that’s literally the job. And lately, everywhere I look, I see the same thing: People are exposing MCP endpoints like they’re REST APIs, and forgetting they’re actually money execution engines. So let’s talk about Token Torching. Yes, I invented another name. This isn’t data theft. It’s not taking your service down.

SIEM Automation to Improve Threat Detection and Incident Response

Security professionals often compare their jobs to a game of “Whack-a-Mole,” the arcade game where players try to hit little plastic moles on the head. The moles pop up in a randomly generated way, making it difficult to predict which one will show its little head next.

Top 10 SIEM best practices for modern security operations

Nowadays, it’s not uncommon for enterprise IT leaders to find themselves in a situation that seems like a catch-22. On one hand, they’re expected to make data-driven decisions that improve productivity and profitability in a business. On the other, they’re preoccupied with their core responsibilities such as protecting critical systems, maintaining network security, and accelerating investigations when a security event occurs. Traditional tooling won’t keep up with modern systems.

Decoding the 2025 MITRE ATT&CK Evals: A Call for Clarity and a Guide for Analysts

The latest MITRE ATT&CK Enterprise Evaluations are out, featuring scenarios that emulate sophisticated actors like Scattered Spider and Mustang Panda. While every release of the findings is a significant event for the security community, this year’s evaluation highlights both new and recurring concerns for security professionals.

Using LLMs, CVSS, and SIEM Data for Runtime Risk Prioritization

A recent University of North Carolina Wilmington study tested whether general-purpose large language models could infer CVSS v3.1 base metrics using only CVE description text, across more than 31,000 vulnerabilities. The results show measurable progress, but they also expose a hard limit that matters far more than model selection: Model quality helps, but missing context sets a ceiling on reliability.

PGA of America Trusts LevelBlue as Official Cybersecurity Advisor

LevelBlue and the PGA of America share a commitment to excellence under pressure. As the Official Cybersecurity Advisor of the PGA of America, LevelBlue brings championship standards of protection, continuity, and trust to the organizations that keep the game - and business - moving forward. From fairways to firewalls, LevelBlue safeguards mission-critical operations, member data, and high-profile events with always-on defense, accelerated response, and expert-led security operations powered by AI-driven threat intelligence.

Cyber Resilience, AI Threats & Business Impact: Findings from 2025 LevelBlue Futures Report

Cyberattacks are evolving fast; powered by AI, deepfakes, ransomware, phishing, and growing software supply chain risk. So how prepared is your organization? In this webcast, we breakdown key findings from the 2025 LevelBlue Futures Report (in partnership with FT Longitude). The report is based on a global survey of 1,500 C-suite and senior executives across 16 countries and seven industries, including healthcare, financial services, energy, and manufacturing.

The New CISO Podcast Ep. 139 - Alex Rice | Safety Third: Why Security Shouldn't Be Your Top Priority

In this episode of The New CISO, host Steve Moore speaks with Alex Rice, Founder, CTO, and CISO at HackerOne, about challenging one of cybersecurity's most deeply held beliefs—that security should be the top priority. Drawing from his journey building security programs at Facebook and founding HackerOne, Alex introduces the "safety third" philosophy and explains why accepting that security is never first can actually make you more effective as a leader.

Why AI Transformations in Security Fail Like New Year's Gym Resolutions

Enterprise AI adoption moved fast. Speed mattered. Shipping mattered. Getting AI into production mattered. That phase is over. Security leaders are now asking a harder question: whether the AI already embedded in security operations is safe, explainable, and aligned with how modern SOC teams actually work. The focus has shifted from adoption to trust, specifically explainability, governance, and operational fit.

Exabeam Introduces First Connected System for AI Agent Behavior Analytics and AI Security Posture Insight

Industry leadership expanded with connected capabilities that not only uncover AI agent activity, but centralize investigation, and deliver measurable AI security posture insights.

Elastic Cloud Serverless achieves major compliance certifications across AWS, Azure, and GCP

Securely scale search, security, and observability apps on any cloud provider. We are thrilled to announce a major milestone in our commitment to security, privacy, and regulatory compliance for Elastic Cloud Serverless. Elastic Cloud Serverless has now attained a comprehensive suite of key compliance certifications across all of our available cloud providers: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud (GCP).

Model Context Protocol Server: The Universal Remote for AI Agents

The Model Context Protocol (MCP) is emerging as a foundational interoperability layer for agentic AI, embraced by major platform providers. MCP simplifies how AI models connect to external tools and data. Think of it as a universal remote for security platforms: Instead of building fragile, one-off integrations, MCP allows AI to discover and use capabilities dynamically. For SIEM and detection providers, this shift is significant.

Cloud vs On-Premised SIEM: One or the Other or Both?

While Hamlet asked the existential question “to be or not to be,” most security teams ask an equally esoteric question that ultimately defines their ability to manage alerting and detection: “to deploy on-prem or in the cloud?” When adopting a security information and event management (SIEM) solution, organizations must make a foundational decision around whether to deploy the solution on-premises or in the cloud.