Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

LevelBlue is making a multi-million-dollar investment in a new local Security Operations Center (SOC) in Sydney, going live August 25, 2026. The Sydney SOC gives Australian organizations, with a particular focus on critical infrastructure owners and operators, access to onshore analysts and local escalation pathways, backed by the scale, threat intelligence, and 24/7 coverage of LevelBlue's global security operations.

Healthcare has always run on two currencies: information and trust. Patients hand over their most sensitive data, diagnoses, genetic profiles, mental health histories, on the assumption that it will be protected and that the people (or systems) handling it will treat them with care. Artificial intelligence is now reshaping both sides of that bargain at once.

Originally published by Cybersecurity Insider. Over the past decade, cybersecurity threats have evolved from a technical issue into a key driver of business and operational risk. Artificial intelligence is accelerating that shift even further, changing the game once again. In 2026, AI in cybersecurity is multifaceted: a tool for defense and incident response, but also a powerful accelerator for attackers. AI-enabled incidents rarely stay contained within the security function.

Security leaders are rethinking what they expect from Managed Detection and Response (MDR) providers, prompting the market to enter a new phase of maturity. Organizations are looking beyond containment metrics and response times, evaluating providers based on their ability to deliver continuous risk reduction, operational accountability, and cyber resilience.

For years, security teams and developers alike have struggled with understanding and identifying all security issues affecting their deployed applications. Today, SentinelOne's Wayfinder Frontier AI Services can identify exploitable weaknesses across source code, Software Bill of Materials (SBOM) dependencies, and embedded secrets at unprecedented speed. The problem is that remediation has not accelerated at the same rate.

For years, many business email compromise (BEC) investigations have followed a familiar playbook: an attacker phishes credentials, logs into the victim's mailbox, establishes persistence with inbox rules, monitors communications, and waits for an opportunity to steal money or sensitive information. Today, we're seeing something different at LevelBlue. Across multiple recent investigations, we've observed attackers treating a compromised mailbox as just the first step.

SpiderLabs’ technical review of the July attacks examines the affected technologies, observed activity, and broader threat landscape. The next question is practical: what can small utilities realistically do about it? At many small water and wastewater facilities, there is often no dedicated security team to understaff. A licensed operator may be responsible for sampling, maintenance, compliance, and after-hours callouts, perhaps with limited support from municipal IT.

When people hear the word cybersecurity, they often picture analysts racing to stop an attack in real time. Those roles are absolutely critical, but a lot of effective security happens long before an alert ever appears. As Director of Operational Intelligence (OpsIntel) at LevelBlue, my job isn't to respond to every incident myself.

You deployed Zscaler, passed the audit, and got leadership's sign-off. The project closed, and the dashboard has been green ever since. That moment is usually right about when the real risk starts to take shape.