Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

There's growing concern that AI automation is removing the hands-on experience junior analysts need to develop into senior defenders. In this Intel Chat, Matt Bromiley and Chris Luft challenge that assumption. Matt breaks down why the traditional entry-level path of endless log review and alert triage was never the best training ground to begin with. Log detection, alert triage, and drift detection are often cited as how defenders learn the trade. But most analysts never had time to get to drift detection because they were buried in repetitive work.

We discovered hackers were testing Shai-Hulud 2.0 three days before the attack. Our researcher Guillaume Valadon explains how GitGuardian's data helped us warn hundreds of companies who didn't even know they were compromised.

Watch our security researcher Guillaume Valadon break down the sophisticated ShaiHulud 2.0 attack where malware exfiltrates secrets directly to GitHub using stolen developer credentials.

Privileged access management has long aimed to control powerful accounts, yet many environments still carry excessive permissions and weak accountability. Password vaults, rotating credentials and stronger governance place controls around admin accounts, linking PAM, access control and identity security to limit damage when something goes wrong.

Ever wondered who answers when you call a cybercriminal? What happens in the aftermath of a Scattered Spider breach? Or why cybercriminals use legitimate platforms to send phishing emails? If so, this is the session for you. Join Jack Chapman, KnowBe4’s SVP of Threat Intelligence, as he pulls back the curtain on these topics. Jack will give you a first look at our latest Phishing Threat Trends Report, walking through attack scenarios and sharing the trends that are shaping the threat landscape.

In this Masters of Data episode, we welcome back Chas Clawson to discuss building effective threat hunting programs from the ground up. We explore the difference between proactive threat hunting and detection engineering, emphasizing how AI tools are making sophisticated security operations accessible to teams of any size. We cover practical approaches, such as prioritizing threats based on business risk, creating feedback loops between red and blue teams, and measuring success through meaningful metrics rather than vanity numbers.

The Salesloft/Salesforce incident revealed the danger of BLA 5: Artifact Lifetime Exploitation. The flaw is simple: the application fails to expire tokens and sessions properly. Stolen OAuth tokens that should have been short-lived were used to steal AWS keys, Snowflake tokens, and passwords. Key Takeaway: If an artifact is meant to be short-lived (a token, a session, a temporary file), it must be retired immediately upon expiration. Rotate your keys aggressively!

Security teams are drowning in alerts, and AI might not be the answer everyone thinks it is. In this episode, Erik Bloch, VP of Security at Illumio, breaks down the math on why AI-powered alert triage may be financially unfeasible for most organizations. With 85 to 90 percent of alerts being non-malicious, security teams are still sorting through massive volumes of noise to find the real threats. Many vendors are betting that AI will solve this problem by triaging alerts at scale. But the reality?

Recent UK breaches highlight how commoditised attacks and dark net markets provide ready stolen credentials for intrusions. Continuous authentication and behavioural analytics shift focus from the initial login to how a user interacts with data and resources, helping detection when attackers try to impersonate genuine behaviour.

From machine to intelligent identity: The AI security challenge.