Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Stopping an Intrusion Doesn't Mean the Incident Is Over

When unauthorized access is detected and blocked, the threat might seem contained. But locking the attacker out doesn't answer the most critical questions: What did they do before they were discovered? What did they access? Were they able to exfiltrate data? This is what happened in the recent cyberattack on France's General Directorate of Public Finances. In late June, the agency detected multiple instances of unauthorized access during a routine check and immediately shut them down.

What our customers say about LimaCharlie

We asked the people who run security on LimaCharlie what changed for them. Nothing here is scripted. "The thing that took the human 16 hours takes the coding agent six minutes." "We put our AI agent through what we call SOC school. And now we're at the point where that AI agent is serving as that tier 2 analyst reliably." "It's literally everything that we wanted.".

The Rest Runs on LimaCharlie

Priya keeps 40 companies safe, usually before lunch. Her team works across a dozen security products. Each one has its own screen, its own bill, and lately its own AI assistant offering advice. Advice is nice. Priya needs the work done. Cloud providers changed how companies buy computing. LimaCharlie does the same for security operations. Endpoints, cloud accounts, email and code all run on one foundation. So when a phishing email lands, one system sees who opened it, what ran on their laptop, and which cloud accounts they can reach.

Grok Bot followed a poisoned setup. LimaCharlie caught it. | Securing Grok Bot with LimaCharlie

Grok Bot runs commands and installs software on its own computer all day, and the chat only shows you what it finished. In this demo, we secure a Grok Bot with LimaCharlie by sending it one message. The bot installs the LimaCharlie sensor and browser extension, turns on 10 detection rules, and creates a Security Manager routine for alerts.

How Long Can a Misconfiguration Go Undetected?

Cloud applications are constantly evolving to accommodate new users, tools, and ways of working. However, every adjustment can also alter who has access to resources and what they can do with them. A misconfiguration occurs when an active setting fails to meet established security criteria. It can grant more access than necessary, keep an insecure protocol enabled, allow certain actions for too many users, or open a pathway for information to leave the organization.

The Biggest Crypto Heist Ever - The 443 Podcast - Episode 394

This week on the podcast, we cover the $6 billion cryptocurrency theft from Binance. Before that, we give an update on PHP2Shell and one active exploit campaign targeting Palo Alot devices. Additionally, we discuss a compromised Claude Code extension on the Cursor AI marketplace.

How to Stop a Malware Campaign That Can Shift Its Infrastructure

MSPs are used to blocking malicious domains, detecting suspicious IP addresses, and continuously updating their defenses against emerging threats. However, what happens when attackers can shift their infrastructure in near real-time without interrupting the campaign? The ErrTraffic campaign, analyzed by the WatchGuard Threat Lab, provides an example of how malware distribution techniques are evolving.

Tales From the Shadow AI | WatchGuard Webinar

Join WatchGuard’s Corey Nachreiner and Marc Laliberte for a deep dive into Shadow AI breaches from 2025 and 2026. You’ll hear about an AI coding agent that wiped a live database during a code freeze and a hiring chatbot whose admin login was 123456. Then they'll show you how to find the same risks across every client you manage with WatchGuard Cloud Detection and Response (CloudDR).

Skip Trace: Delivering NDR without the Complexity | WatchGuard Webinar

Network Detection and Response (NDR) has traditionally come with a heavy price tag, including complex deployments, expensive infrastructure, constant tuning, and skilled analysts to manage the workload. That model was built for enterprise SOCs, not MSPs protecting dozens or hundreds of customers.