Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Part two of CYJAX's rail cybersecurity series looks at why generic threat intelligence falls short in a rail environment, from safety-constrained response options to legacy protocols and a fragmented supply chain, and what rail-specific intelligence needs to deliver instead.

The first time an MCP (Model Context Protocol) server felt real to me, it wasn't because of a clean demo. It was because of the noise. TL;DR: The harness matters more than the protocol, and the evidence matters more than both. MCP earns its keep when it shortens the path from a good security question to trustworthy evidence, and almost everything interesting about making that work happens in the harness wrapped around the model. In this series, I will cover how to build an MCP for an AI SOC.

Dynamic access management replaces long-lived permissions with access that adapts to the user, task, resource, and level of risk. This guide explains how dynamic access decisions work, how they differ from traditional role-based models, and where they provide the most value across production environments, cloud infrastructure, databases, and machine identities.

On July 13, 2026, NSA, CISA, the FBI, and co-sealing partners from twelve other countries published AA26-194A, a joint Cybersecurity Advisory (CSA) warning that Center 16 of Russia's Federal Security Service (FSB) continues to exploit vulnerable and poorly configured network devices across the defense industrial base, communications, energy, financial services, government facilities, and healthcare sectors. The advisory does not reference new exploits.

The modern security landscape is an unfair fight. The perimeter is gone—replaced by a borderless terrain where a team of one to 10 is expected to defend the same footprint as a 50-person security operations center (SOC). Attack surface. Vendor ecosystem. Workforce identity. Even fully-staffed teams struggle to cover them all. For a lean team, that coverage fractures almost instantly.

BlueVoyant SOC (Security Operations Center) and Threat Fusion Cell (TFC) teams are tracking a long-running phishing and remote access campaign that uses DocuSign/e-sign themed lures and a reusable web kit to drive victims into installing legitimate remote access tooling.