Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

At.conf25, we announced how Splunk Enterprise Security (ES) has transformed to today’s AI-powered SecOps platform—unifying industry-leading technologies across SIEM, SOAR, User and Entity Behavior Analytics (UEBA), threat intelligence, and detection engineering with purpose-built AI across the entire Threat Detection, Investigation, and Response (TDIR) workflow—empowering Security Operations Centers (SOCs) to end analyst fatigue, deliver faster security outcomes, reduce risk, and build r

AI is transforming how security operations centers (SOCs) work, but the hype can outpace the reality. You don’t need to build custom models or deploy cutting-edge platforms to benefit. Chances are, you already have AI-powered capabilities in your SIEM, SOAR, or security data platforms. The question is: Are they doing anything useful? This practical playbook lays out six key priorities to increase productivity and effectiveness while maintaining control.

Cybersecurity teams worldwide have been fighting against ransomware attacks on ESXi infrastructure for years. ESXi is a lightweight, bare-metal hypervisor developed by VMware that allows multiple virtual machines to run on a single physical server. ESXi is widely used in enterprise environments, often hosting virtual machines that support essential services for an entire organization.

Steganography is the art of hiding information inside a seemingly ordinary, legitimate object so that no one suspects anything is hidden. The technique T1027.003 has been around for a long time and is increasingly used by malware authors and threat actors to avoid detection. This involves hiding malicious payloads inside innocent-looking files such as images, audio, or documents. By embedding malware in these files, attackers can bypass traditional security tools that scan for obvious threats.

Financial institutions face a harsh reality. As cyberattacks have become more sophisticated and move with greater velocity, a single incident can ripple across IT systems, payment networks, and customer accounts long before the organization can respond. The problem? Most security, fraud, IT operations, and risk teams still operate in silos. Each team monitors their own consoles, works from its own data, and follows its own playbooks.

Welcome, Chefs! Today we are excited to announce the release of The Threat Hunter’s Cookbook: a practitioner’s guide to learning, expanding, and applying your analysis repertoire for threat hunting. In this kitchen, our main ingredient is data!

What if I told you that compromised credentials still remain the number one avenue of initial access in all cyber security breaches? It’s no exaggeration — according to the Cisco Talos IR Trends report for Q1 2025, over half of all incidents reported involved the use of valid credentials. The 2025 Verizon Data Breach Investigations Report claims credential abuse accounted for 22% of all confirmed breaches.