Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

You can't secure what you can't see: Why AgentCore logs matter

AI agents are finally moving past cute demos and into actual production workflows. With AWS AgentCore, teams can build agents that write tickets, call APIs, deploy infrastructure, invoke external tools, and make changes faster than any human operator ever could. That’s powerful, but it also introduces a brand-new operational and security surface. And here’s the uncomfortable truth: most organizations have no idea what their agents are actually doing. Agentic AI isn’t magic.

Why your security analytics needs proactive threat hunting

Even the mightiest and most prestigious companies and enterprises are not exempt from the sophisticated threats posed by cyber attackers. Your security team needs robust security measures for network security, endpoint security, threat detection, anomaly detection, data protection, security monitoring, application security and information security.

Why your security needs a modern SIEM solution

Not investing in a Security Incident and Event Management (SIEM) solution means you’re missing out on significant business benefits. A SIEM platform provides real-time detection and response to security incidents, helping you reduce the risk of costly compliance violations. Combine that with SIEM use cases such as consolidating and streamlining reporting, and your security team saves time and operational costs.

Faster security investigation with Cloud SIEM playbooks

Playbooks — and automated processes in general — were once primarily associated with security orchestration, automation and response (SOAR) platforms, but that has changed recently. Many modern security information and event management (SIEM) solutions have started incorporating SOAR-like functionality, enabling you to automate security workflows and improve your mean time to detect (MTTD) and mean time to respond (MTTR).

Why the Gartner Critical Capabilities for SIEM report belongs in every buyer's toolkit

Have you ever wished for a tool that could guide you, even on the foggiest days? That was my father’s compass. He carried it not because it told him where he was, but because it reminded him where true north was. I spent twelve years in the U.S. Navy as a cybersecurity practitioner, and that same compass has stayed with me. And in the world of SIEM and threat detection, the Gartner Critical Capabilities for Security Information and Event Management (SIEM) report feels like that compass.

Ep 15: Beginner's guide to security tools

In this episode, we run through our beginner's guide to security tools, emphasizing the importance of people, processes, and technology. We chat about the NIST framework as a foundational resource for building security programs, highlighting key steps such as identifying and managing risks. We also discuss basic tools like password managers and multifactor authentication as essential for enhancing security, particularly against threats like phishing. Finally, we explore the integration of AI in security and its potential to improve efficiency while maintaining human oversight.

Ep 14: Security IS observability: Prove us wrong

In this episode, we discuss the critical intersection of security and observability within organizations. We highlight the often contentious relationship between security analysts and SREs, emphasizing the importance of fostering a collaborative culture to effectively address incidents. All teams should focus on solutions rather than blame, as user experience is affected by both security and infrastructure issues. We explore how to break down silos, especially in the context of AI security, and encourage cross-disciplinary learning to enhance overall security practices.

Ten modern SIEM use cases at cloud scale

The role of SIEM has never gone away. From the beginning, it’s been the backbone of security operations: the system where logs converge, alerts are analyzed, and incidents are investigated. What’s changed is our ability to use it correctly. Legacy, traditional SIEM tools forced trade-offs. Teams filtered data at ingest, dropped logs to control costs, or siloed analytics into disconnected point tools. The result was a SIEM that felt heavy, reactive, and underwhelming.

OCSF for Security Hub: Sumo Logic and AWS speaking the same language

In technology, the proof of a lasting relationship is in the infrastructure — the pipelines, security services, and log plumbing have to work seamlessly together long before anyone sees the outcome. That’s precisely what Sumo Logic and AWS have built. Aligned around open standards like OCSF (Open Cybersecurity Schema Framework), integrated with services like Security Hub and GuardDuty, and connected through shared telemetry, it makes cloud security and observability possible at scale.