Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sumologic

Everything you need to know for a career in cybersecurity

Jun 30, 2026 By Janet Alexander In Sumo Logic
So, you want to be a cybersecurity analyst. With the rise in high-profile data breaches, privacy concerns and rapid technological advancements, there’s a greater demand for cybersecurity analysts now. And the demand for cybersecurity analysts is only expected to grow. But before you get too far into pursuing this job, let’s look into the basics of this profession. Below, we answer the most frequently asked questions about becoming a cybersecurity analyst.
Read Post
UTMStack

Top 10 Open Source SIEM Tools for 2026

Jun 30, 2026 By cesmng In UTMStack
At 2 a.m., an alert queue full of raw Windows events, firewall logs, and duplicate detections stops being a tooling problem and becomes an operations problem. The team does not need another dashboard. It needs a SIEM that can ingest the right data, normalize it, correlate it well enough to surface real incidents, and stay maintainable after the initial rollout.
Read Post
UTMStack

AI Powered Threat Detection: CISO's Guide

Jun 29, 2026 By cesmng In UTMStack
The market is giving CISOs a blunt signal. AI-powered threat detection and response was valued at USD 5.59 billion in 2024 and is projected to reach USD 23.52 billion by 2032, at a 20.00% CAGR according to Kings Research on the AI-powered threat detection and response market. That kind of growth doesn't happen because security teams like new tooling. It happens because modern environments generate more telemetry than analysts can realistically review, and attackers move faster than rule updates.
Read Post
UTMStack

VPC Flow Logs: A Practical Guide for Security & Compliance

Jun 28, 2026 By cesmng In UTMStack
A lot of teams only realize they need VPC Flow Logs after an incident has already gone sideways. A workload starts behaving oddly. An analyst sees suspicious outbound connections. Someone asks the most basic question in cloud incident response: what else did this instance talk to, when, and was that traffic allowed or blocked? If you don't have a network record already flowing into your monitoring stack, you're left reconstructing events from fragments.
Read Post
UTMStack

Security Orchestration Tools: A CISO's Guide to SOAR

Jun 26, 2026 By cesmng In UTMStack
Your SOC probably already has good tools. A SIEM collects logs. An EDR catches suspicious endpoint behavior. Firewalls, identity systems, ticketing platforms, and threat intelligence feeds all do their part. Yet the team still spends too much time copying indicators from one console to another, validating the same alert twice, and documenting the response after the fact. That's the operational gap security orchestration tools are meant to close.
Read Post
graylog

Microsoft WinRM Data in Graylog

Jun 26, 2026 By Jeff Darrington In Graylog
If you’re running Windows in your environment, WinRM is one of the most valuable, and most abused channels in your infrastructure. Graylog provides a purpose-built way to make those logs immediately actionable. The Microsoft WinRM Content Pack, available with an Illuminate license and Graylog Enterprise or Graylog Security, delivers ready-to-use parsing rules, streams, GIM categorization, and a dashboard so you can turn raw WinRM operational events into structured, searchable security intelligence.
Read Post
UTMStack

Automation in Security: Fast Track to Compliance

Jun 25, 2026 By cesmng In UTMStack
Manual security operations don't just slow teams down. They make breaches more expensive. Organizations that implement advanced security automation cut breach response time by over 100 days and save an average of $3.05 million per incident, according to JumpCloud's 2024 analysis. That number reframes the conversation. Automation in security isn't a convenience feature for mature SOCs. It's an operating model.
Read Post
graylog

The Definitive SOC 2 Compliance Guide

Jun 25, 2026 By The Graylog Team In Graylog
Every day, service organizations handle sensitive customer information covered by data protection laws and subject to security compliance requirements. In the business-to-business world, customers require that their vendors provide validation and assurance over their privacy and security controls, typically asking for independent third-party attestations and reports.
Read Post

The New CISO Ep. 147 - Walt Powell | CISO 3.0: The Playbook for Delivering Impact and Influence

Jun 25, 2026 By Exabeam In Exabeam
What separates a CISO who survives from one who shapes the boardroom? In this episode, Steve Moore sits down with Walt Powell, Lead Field CISO at CDW and author of The CISO 3.0, to unpack the modern CISO playbook—why technical credentials alone no longer cut it, how to build personal eminence, and why most security leaders are still treated as second-class C-suite citizens.
View Video
datadog

Automatically enrich security logs with MITRE ATT&CK context before they reach your SIEM

Jun 24, 2026 By Danielle Park In Datadog
To detect and investigate threats, security teams need to collect telemetry data from identity providers, cloud platforms, web application firewalls, and endpoints. But these diverse sources describe the same tactics, techniques, and procedures (TTPs) differently according to their own vendor-specific language. For example, a failed Windows logon appears as an event ID, while an Okta account lockout appears as an identity event.
Read Post
UTMStack

CMMC Compliance Requirements a Practical Guide for 2026

Jun 24, 2026 By cesmng In UTMStack
A lot of defense contractors are in the same spot right now. A solicitation lands, the DFARS language gets stricter, someone asks whether the company is “CMMC ready,” and the room gets quiet because nobody is fully sure what that means in operational terms. Usually, the first instinct is to gather policies, dust off the old SSP, and start checking controls in a spreadsheet. That's not enough anymore. CMMC doesn't reward paper maturity.
Read Post
exabeam

Why Short Correlation Windows Miss Insider Risk

Jun 24, 2026 By Exabeam In Exabeam
Short correlation windows miss insider risk because misuse develops gradually, often over longer periods than detection models track. Short correlation windows miss insider risk because misuse often spans longer periods than detection models track. When context resets at fixed intervals, small behavioral changes fail to accumulate into visible risk. When context resets at fixed intervals, behavior is evaluated in disconnected segments.
Read Post
UTMStack

ISO 27001 Requirements: A Guide for 2026 Certification

Jun 23, 2026 By cesmng In UTMStack
If you're working toward certification, you're probably dealing with the same pattern many organizations encounter. Policies live in shared folders, risk decisions sit in meeting notes, control owners answer questions differently, and audit prep turns into a scramble to prove that security work happened. The hard part usually isn't understanding that ISO 27001 matters. It's translating the standard into repeatable operational evidence.
Read Post
graylog

The World Cup Creates the World's Largest Attack Surface

Jun 22, 2026 By Jeff Darrington In Graylog
When 48 teams, 104 matches, 16 host cities, and a broadcast audience approaching half the planet converge across six weeks, something else converges at the same time: opportunity for the people trying to exploit it. The 2026 FIFA World Cup is the most complex digital event in history, and the security challenge it creates is not limited to the tournament organizers.
Read Post
UTMStack

Network Traffic Analysis: A Guide to Modern Threat Detection

Jun 22, 2026 By cesmng In UTMStack
Your team probably already has a SIEM, endpoint telemetry, firewall logs, and a growing backlog of alerts no one wants to tune right before a board update. Then an incident review exposes the same problem security leaders keep finding: the attacker didn't need to defeat every control. They only needed to move through a part of the environment no one was watching closely enough.
Read Post
UTMStack

Behavior Anomaly Detection: A Practical Guide for 2026

Jun 21, 2026 By cesmng In UTMStack
Your SOC probably already has alerts for known bad hashes, suspicious domains, impossible travel, and malware signatures. Then an incident still slips through. The attacker uses valid credentials, touches systems the user can normally access, and moves slowly enough to stay below static thresholds. Nothing looks obviously malicious in isolation. The problem isn't visibility alone. It's that your tools are still asking, “Have I seen this exact pattern before?”
Read Post
UTMStack

Threat Detection and Response Solutions: A Complete Guide

Jun 20, 2026 By cesmng In UTMStack
For those evaluating threat detection and response solutions, the underlying issues are often a persistent reality: The firewall says one thing, the endpoint tool says another, cloud alerts pile up in a separate console, and the compliance team still asks for evidence that no one can assemble quickly. Analysts waste time pivoting between tools when they should be deciding whether an incident is real and what to contain first.
Read Post
UTMStack

Flawless Network Security Audit: 2026 UTMStack Guide

Jun 19, 2026 By cesmng In UTMStack
You're probably in one of two situations right now. Either an external auditor is already on the calendar and your team is scrambling to prove controls exist, or you've inherited a security program that looks mature from the slide deck but falls apart when someone asks for evidence. That's where a network security audit usually goes wrong. Teams treat it like a project with a start date and a finish date, when it works better as a validation loop. Its ultimate goal isn't to produce a thick report.
Read Post
UTMStack

The 10 Best Vulnerability Scanning Tools for 2026

Jun 18, 2026 By cesmng In UTMStack
At 8:30 a.m., the scan report is already out of date. New cloud instances came online overnight, a container image was rebuilt, developers shipped code, and the security queue is full of findings that still need triage, ownership, and context. The hard part is rarely detection. The hard part is deciding what to fix first and getting that decision to flow into the systems your team already runs every day.
Read Post
graylog

What Singapore's CCoP 2.0 Requires of Critical Infrastructure Owners

Jun 18, 2026 By Jeff Darrington In Graylog
Picture Singapore’s largest telecommunications network. It carries the financial transactions, emergency communications, and government data of a city-state of nearly six million people. Now picture that infrastructure silently infiltrated for months by a state-linked espionage group, undetected until the telcos’ own security teams found it.
Read Post

Put agentic AI to work: Real-world defense against threats

Jun 18, 2026 By Elastic In Elastic
Attackers are using AI to compress timelines from hours to minutes. Most SOCs, and most security platforms, weren’t built for that speed. Join Elastic Security product and research experts for a look at how modern security teams can detect, investigate, and respond faster using agentic AI. You’ll learn how to: You’ll leave better equipped to reduce investigation time, keep analysts focused on decision-making, and modernize security operations for machine-speed threats without removing humans from the loop.
View Video
netwrix

Top SIEM Tools for Hybrid Environments in 2026

Jun 18, 2026 By Netwrix Team In Netwrix
Hybrid infrastructure has expanded faster than most Security Information and Event Management (SIEM) tools can keep up with: on-premises AD, cloud workloads, and SaaS each produce telemetry at different quality levels, while identity event normalization and compliance evidence output are the layers that most SIEM deployments address last. The platforms that close those gaps from the initial deployment architecture produce cleaner signals and audit-ready evidence without additional tooling.
Read Post
sumologic

AI across the security lifecycle

Jun 18, 2026 By Michelle Beastall In Sumo Logic
For nearly a decade, the security industry has used machine learning to solve detection. By feeding it enough logs and determining abnormal behaviors, it found the threats that rules-based systems miss. This delivered sharper anomaly detection, fewer false positives, and UEBA is now essential. In fact, threat detection and analytics account for close to 44% of total SIEM spend, the single largest use case by far. Using machine learning for detection was only the start.
Read Post
UTMStack

Incident Response Automation: A CISO's Guide for 2026

Jun 17, 2026 By cesmng In UTMStack
Your SOC probably looks busy on paper and brittle in practice. Alerts land from email, endpoints, cloud workloads, identity providers, firewalls, and ticketing systems. Analysts swivel between consoles, copy indicators into chat, open cases by hand, and race to decide which events deserve containment and which ones are just noise. That model doesn't break because people are careless. It breaks because the volume, speed, and interdependence of modern environments outgrew manual response a long time ago.
Read Post
exabeam

Why Insider Threats Don't Trigger Alerts

Jun 17, 2026 By Exabeam In Exabeam
Insider threats often don’t trigger alerts because the activity relies on valid credentials, approved tools, and authorized workflows. When viewed as individual events, this behavior looks normal and stays below traditional rule thresholds. Risk accumulates across otherwise valid actions without producing a signal that meets alert thresholds.
Read Post
UTMStack

Real Time Threat Detection

Jun 16, 2026 By cesmng In UTMStack
Weekly cyberattacks now average 1,968 per week, up 18% year over year and 70% since 2023, while security teams still take an average of 277 days to identify and contain a breach, according to SentinelOne's cybersecurity statistics roundup. That combination changes the meaning of “real time” in security. It no longer means a dashboard that updates quickly. It means building detection and response so attackers don't get months of freedom between first access and containment.
Read Post

Stop building security dashboards nobody reads

Jun 16, 2026 By Sumo Logic, Inc. In Sumo Logic
On this episode of Masters of Data, we dig into one of data's most contested formats: the dashboard. We explore why so many dashboards get built and never opened, tracing the shift from in-person SOC culture (big screens, shared visibility, immediate feedback) to the remote-work era of folders full of charts no one reviews. The conversation covers North Star metrics, the tension between practitioner and leadership dashboards, and the uniquely tricky problem of security metrics that can look green while a threat actor has quiet dwell time in your environment.
View Video
exabeam

Beyond the Budget: What CISOs Need to Understand About Their CFO Relationship

Jun 16, 2026 By Exabeam In Exabeam
Every CISO has prepared for a budget conversation by building the strongest possible business case. The right data, the right framing, the right numbers. But the security leaders who consistently earn CFO support are not necessarily the ones with the most polished decks. They are the ones who built the relationship that made the ask credible before it ever landed on the table. That distinction came through clearly in a recent conversation between Exabeam CISO Kevin Kirkwood and Exabeam CFO Mike Byron.
Read Post
graylog

FERC and NERC: Cyber Security Monitoring for The Energy Sector

Jun 16, 2026 By Jeff Darrington In Graylog
As cyber threats targeting critical infrastructure continue to evolve, the energy sector remains a prime target for malicious actors. Protecting the electric grid requires a strong regulatory framework and robust cybersecurity monitoring practices. In the United States, the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) play key roles in safeguarding the power system against cyber risks.
Read Post
elastic

Making Waves: Elastic named a Strong Performer in The Forrester Wave: Extended Detection And Response Platforms, Q2 2026

Jun 16, 2026 By Natalie Blake In Elastic
Elastic has been named a Strong Performer in The Forrester Wave: Extended Detection And Response Platforms, Q2 2026 report. The report recognized our SIEM-replacement capabilities, open data architecture, AI innovation, and endpoint protection. Here's what Forrester found and why we believe it reflects what we've been building.
Read Post
UTMStack

Build Effective Incident Response Playbooks a How-To Guide

Jun 15, 2026 By cesmng In UTMStack
The alert hits after hours. A suspicious sign-in turns into endpoint detections, then someone in leadership asks whether customer data is involved, and within minutes the team is juggling Slack threads, ticket updates, legal questions, and a half-dozen console tabs. Most organizations don't fail here because people don't care. They fail because the response lives in people's heads, scattered docs, and outdated runbooks.
Read Post
UTMStack

Ransomware Detection: Master Modern Strategies 2026

Jun 14, 2026 By cesmng In UTMStack
In 2024, ransomware was publicly disclosed in more than 5,600 attacks worldwide, with over 2,600 victims in the United States alone. The same reporting says the FBI's 2024 IC3 report logged 3,156 ransomware complaints, an 11.7% increase from the prior year, which is a useful reminder that this isn't a niche malware problem. It's a persistent operational risk that keeps showing up across sectors and environments (Fortinet's ransomware statistics summary).
Read Post
UTMStack

Security Incident Response: A Guide for SOCs & CISOs

Jun 13, 2026 By cesmng In UTMStack
A breach doesn't become expensive only when systems go down. It becomes expensive when an organization spends months discovering what happened, who needs to decide, what evidence was lost, and which business services can't wait. According to IBM's 2024 Cost of a Data Breach Report, the global average cost of a data breach reached $4.88 million in 2024, while the average time to identify a breach was 194 days.
Read Post
UTMStack

Cloud Security Monitoring: A Complete Guide for 2026

Jun 12, 2026 By cesmng In UTMStack
Your cloud footprint probably grew faster than your monitoring program did. That's the normal path. A team starts with one cloud account, one logging service, and a few dashboards. Then come managed databases, containers, serverless functions, SaaS integrations, new identities, and temporary workloads that appear and disappear before anyone documents them. Security ends up with a pile of logs, a backlog of alerts, and a nagging suspicion that the dangerous activity isn't the stuff already visible.
Read Post
elastic

Monitor Claude activity in Elastic Security

Jun 12, 2026 By Jamie Hynds In Elastic
The agentic security operations platform As more people across an organization start using Claude, security and compliance teams end up asking the same questions they ask about any other system: Who’s using it? How are they signing in? Who’s changing the configuration? Claude’s Compliance API answers all of that. It tracks more than 300 event types across Claude Enterprise, Claude Team, and Claude Platform, and every event arrives with the actor, a timestamp, and where it came from.
Read Post

EU data sovereignty and security operations: how Sumo Logic solves both at once

Jun 12, 2026 By Sumo Logic, Inc. In Sumo Logic
EU organizations in finance, healthcare, telco, and government face a real tension: keep the business running or satisfy an ever-growing stack of data regulations. Most end up choosing one over the other. Sumo Logic and AWS just changed that. At Infosecurity Europe 2026, Bill Peterson, Senior Director of Product Marketing at Sumo Logic, sat down with Sean Martin from ITSPmagazine to break down Sumo Logic's integration with the AWS European Sovereign Cloud — and what it means for security and operations teams operating in the EU. In this interview, Bill covers.
View Video
UTMStack

SIEM on Cloud: Modernizing Threat Detection for 2026

Jun 11, 2026 By cesmng In UTMStack
Your team already knows the pattern. The on-prem SIEM is still running, but it's become a bottleneck instead of a force multiplier. Cloud logs arrive late or in partial form. SaaS activity sits in separate consoles. Endpoint and identity events don't line up cleanly. Analysts burn time pivoting across tools, then still end up asking whether the alert is real. That's why the conversation around SIEM on cloud has changed. It's no longer about chasing a newer deployment model.
Read Post
elastic

Compliance work is overdue for a new approach

Jun 11, 2026 By Smriti In Elastic
Compliance has traditionally lived in dashboards, spreadsheets, screenshots, audit packets, and point-in-time reviews. Security teams know the reality is more dynamic. The evidence auditors need is often buried across identity providers, endpoints, cloud platforms, network controls, vulnerability scanners, alerts, and custom application logs — all generating live operational telemetry that static tools struggle to keep up with.
Read Post
graylog

Why Audit Readiness Accelerates Revenue

Jun 11, 2026 By Jeff Darrington In Graylog
At 3am, you wake up in a cold sweat from a nightmare. The dream? You showed up to test for your most difficult class without having studied. Unprepared, your dream self sat in an uncomfortable desk, staring at a piece of paper and panicking. In the corporate world, an audit can induce the same sense of anxiety and distress.
Read Post
UTMStack

Your Audit-Ready PCI DSS Compliance Checklist for 2026

Jun 10, 2026 By cesmng In UTMStack
Analysts summarized by the PCI Security Standards Council found that breaches in scope for PCI frequently involved card data. Teams already know the risk. The hard part is proving, month after month, that the controls around that data stayed in place and kept working. That is why many PCI DSS audits stall in the same places: scattered evidence, undocumented scope changes, firewall rules that drifted after a change window, and logs that exist but were never centralized.
Read Post
UTMStack

File Integrity Monitoring: A Guide for Modern Security

Jun 9, 2026 By cesmng In UTMStack
You probably already have endpoint alerts, firewall logs, cloud audit trails, vulnerability scans, and a queue full of tickets tied to expected changes. Yet one of the most common blind spots is still simple file drift on important systems. A web server config changes outside the maintenance window. A startup script gets altered so malware survives a reboot. A registry key flips on a server nobody thought to watch closely.
Read Post
exabeam

Securing the Agentic Enterprise with Behavioral Analytics and AI Visibility

Jun 9, 2026 By Exabeam In Exabeam
By mid-2026, the question is no longer whether AI belongs in the enterprise. It’s already embedded in daily work, supporting research, development, customer engagement, and operations. AI agents now act on behalf of employees, automate decisions, and interact directly with enterprise data and systems. This shift creates a new security challenge.
Read Post

LLMs Data Spies or Security Nightmares #podcast #cybersecurity

Jun 8, 2026 By Sumo Logic, Inc. In Sumo Logic
On this episode of Masters of Data, Adam White and David Girvin dig into Sumo Logic's freshly launched compliance apps for Claude, ChatGPT, and LiteLLM, and why your IT team will want to pay attention before the token bill arrives. We unpack how enterprises can move beyond the "AI black hole" era of shadow IT and actually get eyes on who is using what, how much it is costing, and whether any of it is moving the needle.
View Video
graylog

The Four Environments Where SaaS-Only SIEM Fails

Jun 8, 2026 By Jeff Darrington In Graylog
Picture a cybersecurity team responsible for protecting a classified military installation in a remote operational theater. No internet connection. No cloud services. Classified and unclassified networks running on physically separate infrastructure. Their security information and event management system has to detect threats, correlate events, and generate alerts with zero external connectivity, for the entire deployment. That is not a compliance checkbox. It is a physics problem.
Read Post
UTMStack

Unlock Compliance Management Solutions for 2026

Jun 8, 2026 By cesmng In UTMStack
You can usually tell when a compliance program is still running on audit season logic. Three weeks before an assessment, Slack fills with evidence requests. Security exports screenshots from cloud consoles. IT pulls user lists from IAM. HR scrambles to prove termination workflows. Someone opens the spreadsheet nobody has touched since the last audit and starts guessing which controls still map to which systems.
Read Post
datadog

Monitor Claude Enterprise activity with Datadog Cloud SIEM

Jun 8, 2026 By Kyra Abbu In Datadog
As Claude adoption expands across enterprises and workflows, security and compliance teams need to understand who is using Claude Enterprise, how it is accessed, and how it is administered and configured across the organization. The Claude Compliance API gives organizations access to valuable activity data that supports security monitoring, investigations, and governance initiatives.
Read Post

AI Quality EXPLODES Unlock Productivity SECURELY & FAST! #podcast #cybersecurity

Jun 8, 2026 By Sumo Logic, Inc. In Sumo Logic
On this episode of Masters of Data, Adam White and David Girvin dig into Sumo Logic's freshly launched compliance apps for Claude, ChatGPT, and LiteLLM, and why your IT team will want to pay attention before the token bill arrives. We unpack how enterprises can move beyond the "AI black hole" era of shadow IT and actually get eyes on who is using what, how much it is costing, and whether any of it is moving the needle.
View Video

AI is a NEW Gold Rush But Token Burn is STUPID! #podcast #cybersecurity

Jun 8, 2026 By Sumo Logic, Inc. In Sumo Logic
On this episode of Masters of Data, Adam White and David Girvin dig into Sumo Logic's freshly launched compliance apps for Claude, ChatGPT, and LiteLLM, and why your IT team will want to pay attention before the token bill arrives. We unpack how enterprises can move beyond the "AI black hole" era of shadow IT and actually get eyes on who is using what, how much it is costing, and whether any of it is moving the needle.
View Video
UTMStack

Centralized Log Management: Guide, Compliance & Blueprint

Jun 7, 2026 By cesmng In UTMStack
A security alert rarely fails because the team lacks data. It fails because the data is scattered. At 2 a.m., that usually looks familiar. The firewall has one timestamp format. The domain controller has another. The cloud console keeps the event you need behind three menus. The application server writes plain text that only one engineer knows how to read.
Read Post
UTMStack

HIPAA Compliance Automation: Roadmap for CISOs 2026

Jun 6, 2026 By cesmng In UTMStack
Most healthcare security teams don't start thinking about HIPAA automation because they love compliance tooling. They start when another audit request lands, someone asks for six months of access reviews, policy attestations are out of date in three different folders, and the security team spends a week reconstructing evidence that should already exist. The problem isn't that teams don't understand HIPAA.
Read Post
elastic

Agentic SOCs: The public sector's new AI cybersecurity defense

Jun 5, 2026 By John Harmon In Elastic
Adversaries are using AI to launch cyber attacks in record time, forcing security teams to measure responses in seconds instead of hours or days. Detecting these attacks is increasingly difficult. Phishing campaigns built by large language models (LLMs) achieve click-through rates 4.5x higher than traditional methods.1 Public sector organizations are at an inflection point with cybersecurity. Most security stacks in place today weren’t built for this level of speed.
Read Post
UTMStack

Network Device Monitoring: A Complete 2026 Guide

Jun 5, 2026 By cesmng In UTMStack
A lot of teams are in the same spot right now. Users say the VPN feels unstable, finance reports timeouts in a cloud app, a firewall throws intermittent alerts, and nobody can tell whether the problem is congestion, a misconfigured interface, a failing device, or something hostile moving through the network.
Read Post
exabeam

The Price Tag Is Not the Price

Jun 5, 2026 By Exabeam In Exabeam
Most security platform comparisons begin and end with the wrong number. Two vendors submit proposals. One comes in lower. Finance notes the delta, flags the savings, and the conversation shifts. What rarely makes it into that comparison is everything that determines what the platform actually costs once deployed, staffed, scaled, and operating effectively in production. That gap between sticker price and real cost is where security investment decisions quietly go wrong.
Read Post

The New CISO Ep. 146 - Eric O'Neill | Rogue Agents: The New Era of AI Insider Threats (Part 2)

Jun 4, 2026 By Exabeam In Exabeam
What happens when an AI agent inside your company starts behaving like an insider threat? In part two, Steve Moore picks the thread back up with former FBI operative Eric O'Neill to explore how agentic AI is rewriting cybersecurity, the legal traps that follow a breach, and why the modern CISO must think like a spy hunter.
View Video
elastic

How to overcome data gravity and accelerate AI security in the SOC

Jun 3, 2026 By Joe DeFever In Elastic
Security teams ingest massive volumes of telemetry from endpoints, cloud workloads, identity providers, and network controls. The goal is faster threat detection and shorter incident response times. But the reality is that all of this data becomes harder to move, slower to query, and messier to analyze as it grows. That's data gravity, and it's the biggest barrier to effective AI in cybersecurity.
Read Post
exabeam

Where Should Humans Sit in AI-Driven Cybersecurity?

Jun 3, 2026 By Exabeam In Exabeam
There is a huge amount of excitement right now about AI and security operations. Across the industry, we are seeing rapid innovation in areas such as behavioural analytics, AI-assisted investigation, and increasingly agent-based capabilities designed to help security teams process large volumes of activity more effectively. Security teams need that help. The scale of alerts, identities, and telemetry they must manage today has grown far beyond what humans alone can realistically handle.
Read Post
elastic

Protecting critical infrastructure in the AI era: It starts with data

Jun 2, 2026 By Alf Franklin In Elastic
In the public sector, it’s not uncommon for disruptions of critical infrastructure to ripple outward and wreak major havoc on systems and communities whether the cause is a technical issue, a natural disaster, or a cyber attack. As critical infrastructure becomes more connected through distributed systems and IoT devices, the attack surface continues to expand.
Read Post
graylog

Graylog Recognized by Users in the 2026 Gartner SIEM VOC

Jun 1, 2026 By The Graylog Team In Graylog
Analyst reports tell you what vendors do. Peer reviews tell you whether it actually works. The Gartner Peer Insights Voice of the Customer for SIEM is built on verified reviews from real security and IT practitioners who bought, deployed, and operated the platforms they rated. No vendor involvement in the scoring. No pay-to-play placement. Just practitioners saying what worked and what did not. Graylog was included in the 2026 edition of that report. Here’s what our users said.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.