Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

When AI agents look like attackers: what behavioral telemetry tells us

Jul 7, 2026 By Sophos X-Ops In Sophos
An X-Ops analysis of how AI coding agents trigger endpoint detection rules designed for adversaries AI coding agents (Claude Code, Cursor, Codex, and others built on skill packs such as GStack) are showing up in customer environments. They write code, install dependencies, automate browser tasks, and troubleshoot failures by trying alternative approaches.
Read Post
sophos

"Exploit mitigation" stalled around 2008. The attacks didn't.

Jul 6, 2026 By Mark Loman In Sophos
"Exploit mitigation" stalled around 2008. The attacks didn't. AI turns a patched bug into a working exploit in hours. Why endpoint exploit mitigation stalled in 2008, and what a default-on mitigation layer looks like now. The core of my last post was an asymmetry. An attack can unfold in two steps or 20, but the vocabulary it draws from never grows.
Read Post
sophos

Vect and TeamPCP partner for ransomware campaigns

Jul 2, 2026 By Sophos Counter Threat Unit Research Team In Sophos
Counter Threat Unit (CTU) researchers investigated two interconnected threat groups known as Vect and TeamPCP. The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks and the extortion of multiple organizations.
Read Post
sophos

A double-edged bleeding edge: Classifying AI threats

Jun 30, 2026 By Colin Cowie In Sophos
Sophos X-Ops presents a working taxonomy for attacks using, and targeting, AI Conversations about ‘AI threats’ typically collapse into one of two extremes. On the one hand, hype: unverified claims that don’t hold up to scrutiny and invite significant criticism. On the other, dismissal: it’s just old tradecraft with new branding.
Read Post
sophos

The Cybersecurity Poverty Line: Why it exists and why Sophos exists to erase it

Jun 23, 2026 By Joe Levy In Sophos
The Cybersecurity Poverty Line: Why it exists and why Sophos exists to erase it Erase is an ambitious word. We chose it because the agentic era of AI creates a genuine opportunity to change the equation. There are roughly 359 million businesses in the world. Fewer than 35,000 of them employ a CISO. Every framework, product taxonomy, analyst report, compliance regime, and piece of cybersecurity marketing in circulation assumes a senior security leader on the other end.
Read Post

We Gave OpenClaw Red Team Tools (It Found Domain Admin)

Jun 11, 2026 By Sophos In Sophos
Our Red Team handed OpenClaw a penetration testing toolkit and pointed it at one of our own legacy Active Directory networks. 23 findings across 11 attack paths... But the findings aren't the interesting part. What's interesting is how it got there. Work that takes our human team three days took the agent three hours. Mid assessment it hit a wall, reasoned about its own limitations and proposed spinning up an EC2 GPU instance to crack a password hash. Nobody told it to.
View Video
sophos

Sophos recognized for endpoint leadership in SE Labs Awards 2026

Jun 11, 2026 By Sophos In Sophos
Sophos recognized for endpoint leadership in SE Labs Awards 2026 Independent testing confirms what our customers already know: Sophos Endpoint delivers consistent, real-world protection at every tier of the market, from the largest enterprises to small businesses. We’re proud to announce that Sophos has won three awards at the SE Labs Awards 2026: Enterprise Endpoint (Windows), Small Business Endpoint (Windows), and Small Business Security Development.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.