Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

SafeBreach Helm and Anvilogic help security teams accelerate the path from exposure to detection. SafeBreach Helm brings three AI agents together behind a plain-English interface: Analysis Agent — Prioritizes exposures based on real-world risk Validation Agent — Proves which exposures are actually exploitable by running real attacks SecOps Agent — Turns validated gaps into actionable fixes and works with Anvilogic to close the detection gap.

CISA's own red team ran two critical-infrastructure assessments at once — and got opposite results. Host Tova Dvorin and SafeBreach offensive security engineer Adrian Culley break down advisory AA26-237A: how an ESC1 certificate template flaw and a default machine account quota chained into full domain compromise, why one SOC isolated three infected workstations in 10 minutes while the other never noticed, and the cloud identity gaps both organizations shared.

Having the right security platform is only part of the equation. Two organizations can have similar security stacks and still achieve very different outcomes depending on how they operationalize their Continuous Threat Exposure Management (CTEM) program. In this video, learn what separates reactive, ad hoc security validation from a mature CTEM program—including: See how a structured CTEM program can turn continuous security validation into measurable progress across your organization.

Medusa ransomware has went from 300 victims to more than 500, and CISA, FBI, and MS-ISAC just refreshed advisory AA25-071A with new IOCs and TTPs. Tova Dvorin and Adrian Culley unpack the ransomware-as-a-service franchise behind it: the ScreenConnect and Fortinet EMS CVEs still opening doors, three tiers of PowerShell obfuscation, gaze.exe killing shadow copies before AES-256 encryption, and the triple-extortion case where one victim was made to pay twice.

The FBI documented a Medusa ransomware victim who paid the ransom—and was then contacted by a second, separate Medusa actor, claiming the original negotiator had stolen the payment and demanding half the ransom again for the "true" decryptor. That's triple extortion, and it's the strongest argument in the whole CISA/FBI/MS-ISAC advisory (AA25-071A) against paying at all. There is no guarantee the extortion stops when the money moves.

Regulators stopped asking whether you have security controls. Now they want proof the controls actually work. Host Tova Dvorin sits down with Adrian Culley to argue that CTEM has a silent E—for evidence—and that evidence is now the currency of cyber regulation worldwide. Inside: DORA's Article 26 threat-led penetration testing, NIS2's "assess the effectiveness" clause and personal board liability, the SEC's 8-K materiality clock, NYDFS Part 500's personally signed CISO certification, and the EU AI Act's August logging deadline. Subscribe to The Cyber Resilience Brief for more.

The victim had a SIEM. Had EDR. Had a mature program on paper. The controls existed—they just didn't do their job on the day. Offensive cybersecurity expert Adrian Culley on the only way to know whether your stack actually works: run the technique and watch. Dump credentials from LSASS memory—did the EDR block it? Did the SIEM rule fire? Did the SOC see it inside their target window?

For the first time anywhere, the MITRE ATLAS framework and the OWASP Top 10 for LLM applications are written into binding law. Article 15 names data poisoning, model poisoning, adversarial examples, model evasion and confidentiality attacks as threat classes you must have technical measures against—and must be able to evidence to a regulator. The question is no longer whether you have thought about AI security. It is whether you can prove your AI system holds.

The EU AI Act's August 2nd, 2026 deadline just changed shape. Host Tova Dvorin and offensive security engineer Adrian Cully separate what actually lands—Article 50 transparency duties and GPAI enforcement powers—from the high-risk obligations that slipped to December 2027. Inside: Article 15 writes MITRE ATLAS and the OWASP LLM Top 10 into binding law, the DORA / NIS2 / AI Act overlap that makes one incident reportable three times, penalties up to 7% of global turnover, and the five things a CISO should do this week. Part 1 of 2.

A poisoned CLAUDE.md file inside a cloned repository quietly tells a coding agent to send its test logs to an outside endpoint, and the agent complies, shipping environment details, internal system information, and API keys to a server the developer never controlled. The model was not broken. It was obedient. In this episode of The Cyber Resilience Brief (a SafeBreach podcast), host Tova Dvorin and SafeBreach senior sales engineer Adrian Culley break down why building agentic AI controls is not the same as proving they hold under attack.