Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

From weeks to minutes: How Sumo Logic's historic baselining supercharges UEBA

Spotting threats fast and knowing whether they really matter is the name of the game in cybersecurity. That’s where user and entity behavior analytics (UEBA) comes in, and why Sumo Logic’s latest innovation, historic baselining, is a big deal. With this release, Sumo Logic has turned the old UEBA model on its head, delivering insights that used to take weeks of learning time in just minutes. Here’s how and why that’s a game changer.

Ep 4: Stop writing dumb AI security policies: use threat models, not fear

AI policy is not a yes/no question. Security isn’t here to be the morality police. Our job is to enable the business safely. Join security experts Adam White and David Girvin as they chat about the importance of using threat models, a simple framework, and five policy areas you are probably ignoring.

Ep 1: So you're buying your first SIEM...here's how not to suck at it

You’ve been told you need a SIEM. Maybe it was your CISO. Maybe it was your auditor. Maybe your SOC is tired of stitching together logs with duct tape and Python scripts. Doesn’t matter — you’re now on the SIEM buying journey. Congratulations… and condolences. Join security experts, Adam White and David Girvin as they walk through the ultimate playbook for buying your first SIEM without lighting your budget (and your team’s morale) on fire.

Ep 3: CISOs hate their security tools

Sumo Logic’s 2025 Security Operations Insights report surveyed 500 IT and security leaders from enterprise organizations to uncover what’s really happening inside today’s SOCs. Join security experts Adam White, David Girvin, and Zoe Hawkins as they break down the top findings from the report and shed light on what every analyst and CISO has felt for years: the system needs a reset.

Ep 2: Hacked together: fast, safe prototyping with AI

Join security experts Adam White, Chas Clawson, and Seth Williams as they explore how AI-first development is reshaping the way cybersecurity teams build, test, and deploy solutions. Traditional development cycles often leave critical ideas trapped in backlogs, but with Gen-AI and language models, security teams can now move from concept to prototype in hours, not months.

SharePoint "ToolShell" zero day

Hats off to the great work the community and industry has done regarding the “ToolShell” attack against Microsoft’s On-Premise SharePoint servers. The goal of this article is to build on that great work and help Sumo Logic customers with on-prem SharePoint servers investigate and identify evidence within their environments.

Model Context Protocol (MCP) vs Model Control Plane (MoCoP): Why your AI security is screwed if you only have one

If you’re building AI systems with agents, plugins, and orchestration layers and you’re only thinking about how to route traffic, you’re halfway to being pwned. Everyone’s rushing to build a Model Context Protocol (MCP) — and that’s great. But almost no one’s talking about MoCoP — the Model Control Plane, which is just as important and arguably where the riskiest stuff happens. (Also, side note, who the hell keeps making these damn acronyms so confusing?