Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Detection Engineering with LimaCharlie and Claude Code

Detection engineering is fundamentally a translation problem: rules need to be converted between formats, IOCs need to be converted into detection logic, and noisy alerts need to be converted into precise suppressions. That translation work is what consumes analyst time, and it's what Claude Code handles well.

How multi-agent systems work in LimaCharlie

This video walks through how single agents and multi-agent systems are built and run inside the LimaCharlie platform. Agents in LimaCharlie are defined declaratively. Each agent specifies the model it runs, its instructions, the tools it can access, what events trigger it, and the guardrails it operates under. This approach makes agents version controllable, reviewable, and portable across tenants.

Are we blindly giving AI access to everything?

Users are connecting AI tools without understanding the security implications. In this week's Intel Chat, Chris Luft and Matt Bromiley discuss a security breach at Vercel that originated from a compromised third-party AI tool used by one of its employees. The attacker gained control of the employee's Google Workspace account, which provided access to Vercel's internal environment.

AI SecOps Worskhop Series: Detection Engineering with LimaCharlie and Claude Code

This hands-on workshop is designed for security professionals interested in learning how to integrate advanced AI capabilities into their detection and response workflows. Attendees will receive practical, step-by-step instruction on leveraging the power of Claude Code, a sophisticated AI agent, to significantly enhance security operations within the LimaCharlie platform for detection engineering use cases.

Crypto theft, Vercel breach, Mastodon attack, North Korean IT in US & cyber negotiator guilty [316]

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.

Agentic SecOps: Build a security AI agent that automatically investigates detections

A credential access event fired. An AI agent investigated it, correlated it against running processes, assessed the risk, and closed the ticket. No analyst touched it. The entire loop ran in minutes. This is what security operations look like when AI can actually operate in the environment rather than advise from outside it. Security operations have always required a special kind of person.

Unexpected hurdles creating U.S. cyber policies

The early days of U.S. cyber policy were defined by agencies that had no common language and no playbook to follow. J. Michael Daniel, President and CEO of Cyber Threat Alliance and former White House cybersecurity coordinator, talks through what it actually took to coordinate cyber policy across the federal government, build public-private partnerships that work, and stand up an intelligence sharing organization that serves the entire cybersecurity industry.

How to scan your code bases using AI for vulnerabilities with Jeff McJunkin

Join us for this week's Defender Fridays as Jeff McJunkin, Founder of Rogue Valley Information Security, walks through how he built an AI-powered pipeline to scan large codebases for real, exploitable vulnerabilities, using the Linux kernel as his proving ground. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

Fingerprinting AI Attacks: Detection Every SOC Needs

Revisiting a conversation between LimaCharlie co-founder Christopher Luft and Chris Cochran, Field CISO & Vice President of AI Security at SANS Institute, on The Cybersecurity Defenders Podcast. For most of cybersecurity’s history, defenders could operate under a safe assumption: somewhere on the other end of an attack, a human was making decisions. Scripts might automate parts of the kill chain, tools might accelerate execution, but a person was in the loop.

AI SecOps Worskhop Series: Accelerating Cloud Security Operations with Claude Code and LimaCharlie

In this workshop we will show how to use Claude Code with LimaCharlie to accelerate cloud security operations. We will have Claude Code deploy agents, create detections and identify issues before they become incidents. This hands-on workshop is designed to demonstrate the transformative power of integrating Anthropic's Claude Code, with the versatile security platform, LimaCharlie. Our focus will be on leveraging the capabilities of Claude Code to significantly accelerate and streamline various aspects of cloud security operations, turning reactive tasks into proactive, automated workflows.

Logging Is Not Observability: The AI Security Gap MSSPs Can't Ignore

Every MSSP is fielding the same question from clients right now:"Are we safe with AI?" Most are answering with some version of"yes, we're logging everything." In a recent Defender Fridays episode, Saurabh Shintre, Founder and CEO of Realm Labs drew a hard line between these two concepts."You can log prompt and response and this bare minimum you have to do.

When Claude Code Hunts Cobalt Strike: Agentic Security Operations in Action

Security teams enter an asymmetric battle when adversaries freely use AI to wage attacks. The aggressors are armed with top-tier capabilities. Defenders hesitate to adopt AI they can't see, trust, or control. SecOps teams are drowning in alerts and outpaced by adversaries who are unafraid to automate everything. The solution isn't another dashboard or another AI chatbot offering recommendations.

LimaCharlie is the most secure way to run AI security agents

The idea that AI agents will run security operations is becoming reality. But most platforms ignore the most important question: how do you secure the agents themselves? In this video I walk through why LimaCharlie is the most secure platform for running agentic security operations and demonstrate the architectural controls that make it possible. We look at the core mechanisms that allow AI agents to operate safely inside a SecOps environment, including.

Agentic AI at risk after MCP design flaw discovery? #ai #cybersecurity #podcast

In this week's Intel Chat, Chris Luft and Matt Bromiley discuss a design flaw in Anthropic's Model Context Protocol (MCP) that could enable large-scale supply chain attacks on agentic AI systems. Researchers at OX Security found that MCP's command execution allows malicious commands to run silently without sanitization checks or warnings.

China-linked group targets cloud, Russian cyber espionage, agentic AI systems flaw & Nginx [313]

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.

How to know if your agents are correct with Dylan Williams

Join us for this week's Defender Fridays as we explore AI agent evaluation with Dylan Williams, Co-founder and Chief Research Officer of Spectrum Security. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

The Cloud Goes Dark: Can Your SecOps Stack Survive a Regional Outage?

When nation states target cloud infrastructure, MSSPs are at risk. Many security teams have quietly accepted this as someone else's problem. It isn't, and ignoring the problem only increases their risk exposure. A recent episode of the Cybersecurity Defenders Podcast featured a conversation on cloud infrastructure vulnerability between LimaCharlie Co-Founder Christopher Luft and Prophet Security R&D Guru, Matt Bromiley.

The Agentic MDR Pipeline: Detection Engineering at Scale

A CVE surfaces in the morning. By the time you are talking to that customer, you can tell them: we saw it, we checked your environment, you were not affected, and we deployed a rule that will catch it if it ever shows up. For MSSPs and MDR providers, detection engineering is among the most valuable services you can offer. It is also among the most expensive to deliver consistently and at scale.

Build a security investigation agent that responds to detections (agent-as-code)

In this video we demonstrate how to build a custom security investigation agent using LimaCharlie’s agentic SecOps platform. Using the AI Agent Builder and a plain-language prompt, we create an investigation bot called SSH Bot that runs automatically whenever sensitive SSH credential material is accessed on an endpoint. When the detection fires, the agent: The agent is saved as code, allowing it to be triggered by detections, run asynchronously across infrastructure, or executed on a schedule.

Understanding how attackers think & how you avoid threats with Terry Bradley, Mile High Cyber [311]

Terry Bradley, Founder and President of Mile High Cyber, shares how you can uncover vulnerabilities and strengthen your organization's defenses with expert penetration testing and security assessments.

Composable AI Agents and the SOC That Runs Itself

Picture a SOC that investigates its own alerts, hunts threats across customer tenants, isolates compromised endpoints, and writes its own detection rules. Envision the same SOC attacking itself every morning to find the gaps it missed, all before your analysts arrive for the day. This is not a roadmap item, but an operational reality on LimaCharlie. It’s what agentic AI security looks like on a platform built to support it.

What AI Operator-First SOC Looks Like, and Why It Matters Now

There is a version of AI SOC that most security teams are familiar with. It summarizes alerts. It surfaces recommendations. It tells an analyst what to look at next. It is useful in the way a well-organized report is useful: it saves time reading, but the work still happens at a human pace. That version of AI is not what this blog is about. For MSSPs and SecOps teams operating at scale, advisory AI is not a destination. In fact, it presents a bottleneck in a different form.

Claude Code Cuts SOC Setup to 10 Minutes

Security teams accept that standing up a real SOC requires days of configuration, credential wrangling, and infrastructure work before any actual security engineering begins. With LimaCharlie, actual setup time is closer to ten minutes. It gives valuable time back to SecOps teams by managing infrastructure and simplifying onboarding and operations with Claude Code. Using agentic AI to deploy SOC capabilities means your team spends less time on infrastructure and more on security work.

AI in the SOC with Joshua Neil

Join us for this week's Defender Fridays as we explore AI in the SOC with Josh Neil, Co-founder of Alpha Level. At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.

Full SOC Operations with Claude Code: Fork, Install and Run Agents

After RSAC, one thing was clear: security teams don't want a black box AI SOC product and they want to go beyond triage and co-pilots. They want infrastructure they can control, extend, and own. LimaCharlie runs composable AI agents built on real SecOps infrastructure, in production. Our open-source AI triage agents are designed as self-contained, installable units, each with defined scope, permissions, and behavior. Join Maxime Lamothe-Brassard, CEO and Founder, as he walks through the architecture and runs live demonstrations inside the Agentic SecOps Workspace.

Public infrastructure protection depends on analysts with Mike Hamilton, PISCES International [308]

Michael Hamilton, Chief Technology Officer at PISCES International, joins us to discuss the benefits of providing real world experience to students while they protect existing public infrastructure. The resilient future of local government security rests in our ability to adapt to changing threats and adopt new technologies, including AI.

IRGC threatens tech companies, FBI Director hacked, Venom Stealer & Hasbro breach / Intel Chat [307]

In this episode of The Cybersecurity Defenders Podcast, we discuss some intel being shared in the LimaCharlie community. Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform. This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows.