Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The volume, velocity, and sophistication of cyber threats continue to grow. Security teams need a new approach. At AWS Security LIVE! during Black Hat USA 2026, Arctic Wolf President & CEO Nick Schneider joined Amazon Web Services' Jess Kubat, Ryan Orsi and Brian Mendenhall for a discussion on security operations at Machine Speed and how organizations can combine AI-powered capabilities with security expertise to stay ahead of modern threats.

Employees are increasingly adopting AI tools, working across unsecured networks, and bypassing established security practices, often without their organization's knowledge. The result is a growing class of cybersecurity risks that traditional security controls alone cannot address.

The OpenAI model that escaped its testing environment and compromised Hugging Face exposed a much bigger cybersecurity problem: are our existing defences actually designed for autonomous AI attacks? In this Razorwire Raw, James Rees looks beyond the original incident at what happens when AI can identify vulnerabilities, exploit them and move through systems at a speed human defenders simply can't match. From AI security and sandboxing to defensive AI and the possible return of honeypots, it may be time to reconsider what defence in depth looks like in the age of AI.

The FBI documented a Medusa ransomware victim who paid the ransom—and was then contacted by a second, separate Medusa actor, claiming the original negotiator had stolen the payment and demanding half the ransom again for the "true" decryptor. That's triple extortion, and it's the strongest argument in the whole CISA/FBI/MS-ISAC advisory (AA25-071A) against paying at all. There is no guarantee the extortion stops when the money moves.

Medusa ransomware has went from 300 victims to more than 500, and CISA, FBI, and MS-ISAC just refreshed advisory AA25-071A with new IOCs and TTPs. Tova Dvorin and Adrian Culley unpack the ransomware-as-a-service franchise behind it: the ScreenConnect and Fortinet EMS CVEs still opening doors, three tiers of PowerShell obfuscation, gaze.exe killing shadow copies before AES-256 encryption, and the triple-extortion case where one victim was made to pay twice.

Security teams often invest in more dashboards, more alerts, and more visibility. But when does visibility become noise? In this clip, David Clapp explains why security improvements come from actionability, not just awareness, and how organizations can close the gap between findings and decisions.