incident response news
6 stories
CISA Urges Clearer Breach Reporting Amid Rising Cyber Incidents
The Cybersecurity and Infrastructure Security Agency (CISA) has reportedly issued new guidance, signaling a push for enhanced clarity in organizational breach reporting. This advisory indicates a move towards potentially stricter regulations concerning how entities disclose and manage cyber incidents, with a particular focus on improving transparency in incident response and breach…
Inside the Modern SOC: The Identity Front Door
Attackers are increasingly leveraging compromised identities to gain initial access to enterprise environments, with identity weaknesses playing a role in nearly 90% of incidents investigated by Unit 42, a cybersecurity research and incident response team. This trend is highlighted in the 2026 Unit 42 Global Incident Response Report, which also indicates that 65% of initial access activities…
Blackpoint AI SOC Agent autonomously contains identity-based attacks
Blackpoint Cyber has launched its AI SOC Agent, a new feature designed for autonomous response to identity-based threats. This capability, now generally available, aims to detect and contain attacks targeting Microsoft 365 and Google Workspace accounts with minimal human intervention. The system operates on an AI and human hybrid model, with the AI component acting on threats it identifies…
SharpHound Recon Attack – How AI enhanced the threat hunt
At Cisco Live AMER 2026, a novel approach to security operations was implemented by integrating an AI-driven security agent with always-on, full packet capture technology. This setup aimed to automate threat hunting and analysis, protecting conference attendees and infrastructure.
What Working the Cisco Live SOC Taught Me About AI, Detection, and Response
Working within the live Security Operations Center (SOC) at Cisco Live AMER provided valuable insights into the practical application of AI, detection, and response technologies, according to a product manager's recent account. The SOC at the event functions as a real-time security operation, integrating analysts, telemetry, detection mechanisms, and response workflows across the conference…
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects
Kaspersky's analysis of its 2025 compromise assessment engagements reveals a significant number of undetected threats, with many persisting for months or even years. These assessments, which examine networks for signs of compromise, found that a substantial portion of incidents were missed by existing security tools and processes.