Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Discover the top threat actors to watch in May 2026, including OilRig, Cozy Bear, Lazarus, and Charming Kitten. Learn how leading cyber threat groups operate, who they target, and how organisations can stay protected.

If your first instinct when connecting an LLM to enterprise systems via MCP is to strip out all personally identifiable information, you’re building a system that is useless. The “block all PII” approach sounds responsible. It checks a compliance box. But it fundamentally misunderstands what MCP-based AI systems do and why they need data in the first place. The real engineering challenge is not blocking data.

Security operators often struggle with the escalating friction that naturally occurs in their detection and response (D&R) workflow. Detections fire in one tool. Investigations happen in another. Case tracking lives in a third. For MSSPs managing dozens of client environments, fragmentation compounds quickly. Analyst time bleeds into context-switching. SLAs are hard to track. When something goes wrong, reconstructing what happened across multiple platforms is painful.

Cybercriminals are getting smarter and faster. Social engineering attacks are evolving rapidly, and AI is making them more convincing than ever. According to the 2025 Verizon Data Breach Investigations Report, up to 68% of cyberattacks involve some form of social engineering. Meanwhile, 95% of cybersecurity professionals say AI is making phishing attacks harder to detect, and 65% believe attackers will soon rely on AI as their primary tool. This isn’t just theory.

CrowdStrike is excited to announce Falcon OverWatch for Defender, a new offering that extends our elite managed threat hunting to Microsoft Defender environments. The need for proactive threat hunting is increasingly urgent as adversary operations evolve: 82% of intrusions observed in 2025 were malware-free, the CrowdStrike 2026 Global Threat Report revealed, and the fastest eCrime breakout time was a mere 27 seconds. Adversaries using AI increased their attacks 89% year-over-year.

“ AI has fundamentally changed the pace of security operations. Attackers are using automation to scale faster than most internal teams can realistically respond.“

Security operations teams manage a high volume of signals, often across multiple tools. Analysts may triage detections in one system, document progress in another, and coordinate remediation elsewhere. As context becomes fragmented, response times slow and the risk of missed threats increases.

Compliance teams have control over approved corporate systems like enterprise software, managed databases, and internal applications. But they don’t have the same over what employees paste into ChatGPT, upload to Claude, or share with Gemini and other unauthorized AI tools. As such, when auditors review AI usage controls, most organizations discover they can’t prove that employees aren’t exposing regulated data through external AI services.

The initial ESXi configuration after installation is an important step in making sure the host is functional, that is ready to serve as a standalone host or as part of a vCenter cluster. In the previous post, we explained the interactive ESXi installation step by step. Once the installation is done, you need to complete some initial ESXi configuration in the Direct Console User Interface (DCUI) and embedded VMware Host Client.