vectra

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of essential product and service updates, along with reports from the second day of the event. Roundups of announcements from day 1 and the days leading up to the conference are also available. Offensive security firm Assail has launched Ares, an autonomous red-teaming platform designed to discover, chain, and exploit vulnerabilities across APIs, mobile applications, and web applications. Ares is a self-healing, self-teaching platform that autonomously adapts attack strategies in real time and requires no hands-on expertise to manage. BlackCloak has released three new capabilities for its Digital Executive Protection platform. Impersonation Protection, now enhanced with device-level biometric validation and geolocation signals, lets BlackCloak members authenticate the legitimacy of communications from other members in real time via the mobile app. Search Suppression complements the existing Data Broker Removal service by automatically suppressing a member’s PII from search engine results while broker removal requests are still being processed. Member Travel Advisory (coming this spring) delivers AI-synthesized, continuously updated risk analysis across cybersecurity, physical, geopolitical, and social dimensions for every country directly within the app. ConductorOne announced a new integration with CrowdStrike Falcon Next-Gen Identity Security that feeds live threat signals drawn from real-time detections, behavioral analytics, and threat intelligence directly into ConductorOne’s access governance workflows. Security teams can filter and prioritize high-risk identities during access reviews and approval decisions based on real-time activity, rather than risk scores. ConductorOne’s policy engine can also use those Falcon signals to automate responses and trigger a review, deny access, or revoke entitlements the moment risk levels shift. Cyera has introduced a new suite of capabilities, including Browser Shield for AI and Data Lineage, to provide real-time visibility into how employees and autonomous agents interact with sensitive data. Browser Shield prevents data exposure at the prompt level within public AI models, while the Data Lineage tool automatically maps how agents move and transform files across their lifecycle. Additionally, the new Cyera MCP allows security teams to build their own data security agents to automate threat hunting and risk remediation using plain-language queries. CrowdStrike launches cloud security innovations, Falcon Data Security, Agentic MDR CrowdStrike announced new Falcon Cloud Security enhancements to help eliminate cloud risk through adversary-informed prioritization. Organizations can identify cloud exposures most likely to be exploited and their root causes, enabling faster remediation. CrowdStrike also introduced Falcon Data Security, a new data security solution that stops data theft across the agentic enterprise. Falcon Data Security discovers, classifies, and stops data theft in real time. The security giant also unveiled Agentic MDR for managed detection and response. Falcon Complete’s analysts build and deploy intelligent agents to automate high-friction security workflows and stop breaches. Darktrace launches adaptive security awareness training and introduces MSSP offering Darktrace has announced Adaptive Human Defense, which replaces scheduled security awareness training with behavioral AI-driven micro-coaching sessions delivered in real time as risks appear in a user’s inbox. Darktrace also unveiled an expansion of Darktrace / EMAIL to include full-message, cross-channel analysis across email, Microsoft Teams, Slack, and Zoom, enabling detection of blended social engineering campaigns across all four platforms, including prompt-injection threats targeting corporate AI assistants. The company also announced a new managed email security offering for MSSPs, built on Darktrace / EMAIL’s Self-Learning AI. Drata has released three new agentic AI capabilities for its trust management platform. The first, Agentic TPRM Assessment (now generally available), automates vendor security reviews by autonomously accessing live evidence from Drata Trust Centers, evaluating controls against defined criteria, and generating findings, follow-ups, and executive reports. The second, Agentic Questionnaire Response (in beta), manages the full security questionnaire lifecycle from intake and drafting to SME collaboration and final delivery, with configurable human-in-the-loop controls. The third, AI Trust Center Creation, ingests a customer’s existing artifacts and quickly auto-generates a complete Trust Center preview. Eclypsium has released the Eclypsium Supply Chain Security Platform version 4.3. The latest version of the platform provides continuous monitoring of network edge devices for vulnerabilities, indicators of compromise, and unknown binaries that may harbor vulnerabilities and custom malware introduced via the IT supply chain. GC Cybersecurity has unveiled its 5th generation Autonomous Data Protection Platform. The new ISE Autonomous Data Protection Platform is designed to address the growing risk of sensitive data exposure across AI, cloud, and SaaS environments. Powered by agentic AI and a 5th generation cybersecurity architecture, the platform continuously discovers, classifies, and protects data in real time, going beyond traditional perimeter-based defenses. Hadrian has released Nova, an agentic pentesting product that autonomously simulates offensive techniques against an organization’s external attack surface, including chaining vulnerabilities and escalating access across real assets. Testing is customer-scoped and repeatable on demand, with findings reviewed by human experts before delivery. Nova is priced per test and is available immediately. KnowBe4 launches phishing alert button for Microsoft Teams and expands platform KnowBe4 is extending its one-click Phish Alert Button (PAB) to Microsoft Teams, allowing users to report suspicious messages directly within the collaboration platform. The integration enables security teams to manage threats from both email and Teams within a single, streamlined workflow. KnowBe4 also expanded its Artificial Intelligence Defense Agents (AIDA) platform with deepfake training agents that generate custom, high-fidelity deepfake simulations featuring an organization’s own leaders to train employees on how to spot AI-generated impersonations. Living Security announced the general availability of its AI-native Human Risk Management platform. Powered by the Livvy AI risk intelligence engine, the platform is designed to secure the “hybrid workforce” — both human employees and AI agents operating across enterprise systems. The platform analyzes behavioral signals across the workforce to identify risk, explain why it matters, and guide remediation before incidents occur. Huntress has expanded its Managed Identity Threat Detection & Response (ITDR) product to cover Google Workspace, adding to its existing Microsoft 365 coverage. The solution detects anomalous authentication activity, attacker-created Gmail inbox rules designed to suppress MFA notifications or hide security alerts, and logins from data center providers commonly associated with threat actors. iCOUNTER announced the general availability of its Counter Threat Operating System (CTOS), a new platform designed to introduce “compromise intelligence” as a control layer for third-party risk. The initial release includes CTOS-TPR, which detects early-stage adversary activity such as reconnaissance and targeting aimed at vendors and partners. By continuously monitoring threat activity and mapping it against an organization’s extended ecosystem, CTOS enables companies to identify and act on risks before they lead to breaches. Miggo is expanding its Runtime Defense Platform to protect AI and agentic environments, with new capabilities including AI-BOM, runtime guardrails and agentic detection and response. It tackles the fact that agents are making decisions dynamically at runtime, so security teams need visibility and protection where models, tools and data actually interact. The enhancement gives security teams visibility and control over AI agents, MCP toolchains and Shadow AI running in production. NetRise launched Provenance, a new product that identifies risk associated with contributors to the open source components inside enterprise software and connected devices. Provenance adds a layer of trust and intelligence to the NetRise Platform, enabling teams to see a variety of project health signals, including advisory relationships and how compromises propagate through dependency graphs, defining a blast radius from a malicious contributor. Novee has launched autonomous AI red teaming for LLM applications, designed to uncover flaws in chatbots, copilots, and agents. It tests for real AI-specific attack paths such as prompt injection, jailbreaks and agent manipulation rather than relying on traditional appsec approaches that were not built for AI behavior. Nudge Security adds new AI agent discovery capabilities Nudge Security announced an expansion of its platform with the addition of AI agent discovery, enabling customers to gain immediate visibility and control over agent identity and permissions. The new capabilities discover AI agents at the source of creation, understand their access risks, and engage their human creators to gain additional context regarding the scope of use for each agent. RSA has announced expanded integration with Microsoft, adding support for the new Microsoft 365 E7: The Frontier Suite through RSA ID Plus for Microsoft, which provides authentication for both human users and AI agents across hybrid, cloud, and on-premises environments. Separately, RSA announced several new passwordless enhancements: a next-generation desktop passwordless client for macOS and Windows, enhanced mobile passkeys with proximity verification, and datacenter passwordless support for Linux and other OS servers. Sectigo has introduced the Sectigo Partner Platform (SPP), a multi-tenant CLM platform designed for MSPs, MSSPs, VARs, and distributors. Unlike single-tenant alternatives, SPP gives each end customer a fully isolated tenant with separate certificate inventories, usage reporting, billing, and admin controls, all managed through a single partner interface. The platform integrates with Sectigo Certificate Manager (SCM) and automates certificate validation, issuance, and renewal workflows. SPP is currently available to a limited number of channel partners, with broader rollout planned. SentinelOne and LevelBlue are combining SentinelOne’s Purple AI and Singularity Platform with LevelBlue’s threat intelligence and Indigo platform to give organizations a unified, AI-powered security operations model, covering MDR, managed SIEM, and incident response in one place. The goal is to reduce dwell time and fragmentation that make most enterprise security stacks hard to manage. Sentra announced a new solution to help organizations securely adopt Google Workspace with Gemini by addressing key AI adoption risks. The platform tackles four core risks: shadow and unused sensitive data, over-permissioning, incorrect or missing labels, and data leakage through AI-generated outputs, using in-place discovery, classification and automated labeling. These capabilities give organizations the visibility and controls needed to maintain data governance, compliance and cost efficiency while preparing for AI. Skyhawk Security has introduced a new Threat Actor Context capability that maps simulated cloud attack scenarios to known adversary tradecraft, campaigns and CVEs. The product enhancement was built for prioritization. It gives security teams more context on which attack paths are most relevant based on real-world threat activity, helping them focus on the true risks to critical assets. Tenable has introduced Hexa AI, an agentic AI engine within the Tenable One platform that automates security workflows and transforms exposure intelligence into coordinated action. Hexa AI helps security teams prioritize and remediate risk at machine speed across IT, cloud, identity and AI environments. By leveraging Tenable’s Exposure Data Fabric, the platform enables organizations to move from reactive response to proactive, continuous risk reduction. Vectra AI has expanded its platform with three new exposure management capabilities. The first is a passive, agentless continuous asset inventory that automatically discovers and tracks unmanaged, OT, and IoT devices across hybrid environments. The second is proactive exposure detection, which identifies observed security and compliance gaps such as risky protocol usage, weak encryption patterns, and exposed credential files. The third is environment observability, providing network-wide visibility into PQC readiness, Zero Trust posture, data movement, and network performance. Zscaler publishes threat research and announces new integrations Zscaler has published its Threatlabz 2026 VPN Risk Report, which shows that 51% of organizations experienced a VPN-related security incident in the past 12 months. The study also found that only 5% trust their VPN infrastructure to detect and stop AI-enabled threats, and only 6% of organizations can deploy a critical VPN patch within 24 hours. Zscaler also announced that it’s now part of Databricks’ new Open Security Lakehouse Ecosystem, which unifies all structured and unstructured security data into a single platform that integrates with any tool to enable social engineering detection, insider threat detection, and anomaly detection.

Week in review: ScreenConnect servers open to attack, exploited Microsoft SharePoint flaw Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What smart factories keep getting wrong about cybersecurity In this Help Net Security interview, Packsize CSO Troy Rydman breaks down the biggest vulnerabilities in smart factory environments today, from IoT devices and legacy systems to human error. He explains how unmanaged devices, from sensors to robotic components, often go unpatched and become entry points for attackers. Certificate lifespans are shrinking and most organizations aren’t ready The push for shorter TLS certificate lifespans has grown for years. Google first promoted 90-day certificates, and Apple later proposed 47-day ones, prompting the CA/Browser Forum to set a formal timeline. That plan cuts validity from one year to 200 days, then 100, and finally 47, forcing organizations to rethink certificate purchasing and management. Stop building security goals around controls In this Help Net Security interview, Devin Rudnicki, CISO at Fitch Group, argues that security strategy fails when it loses its connection to business outcomes. Rudnicki walks through how to align security goals with corporate priorities, why CISOs must present risk in terms leadership can act on, and how to balance innovation speed with measured risk. AI got it wrong with high confidence. Now what? In this Help Net Security interview, Christian Debes, Head of Data Analytics & AI at SPRYFOX, talks about the growing gap between what AI models do and what their operators can explain. He argues this gap is already a liability, particularly when decisions affect people or money and no one can say why a model produced a certain output. Field workers don’t need more access, they need better security In this Help Net Security interview, Chris Thompson, CISO at West Shore Home, discusses least privilege and credential hygiene for a field-based workforce. He covers access management, authentication practices, and data risk processes that support employees in the field. Thompson also outlines security awareness efforts and how field teams are integrated into an organization’s security posture. CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963) CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers. The confirmation comes from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday. DarkSword: Researchers uncover another iOS exploit kit A powerful iPhone hacking toolkit dubbed “DarkSword” has been used since November 2025 to compromise devices by exploiting zero-day iOS vulnerabilities, Google researchers have shared. Two weeks ago, Google Threat Intelligence Group (GTIG) and iVerify disclosed the existence of Coruna, a spy-grade iOS exploit kit that has been used in a commercial surveillance operation, by state-linked threat actors engaged in cyber espionage, and cybercriminals. Unpatched ScreenConnect servers open to attack (CVE-2026-3564) ConnectWise has patched a critical vulnerability (CVE-2026-3564) that could enable attackers to hijack ScreenConnect sessions by abusing ASP.NET machine keys to forge trusted authentication. The ScreenConnect remote access platform is popular with managed service providers, IT departments, and technology solution providers. They can opt for the cloud-hosted version or can deploy it on their own servers or in their private cloud. Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed. What to do in the first 24 hours of a breach In this Help Net Security video, Arvind Parthasarathi, CEO of CYGNVS, walks through a 10-step process for handling a cybersecurity breach. The first five steps cover preparation, while the next five address what to do once a breach is underway. Cloud misconfiguration has evolved and your controls haven’t In this Help Net Security video, Kat Traxler, Principal Security Researcher – Public Cloud at Vectra AI, walks through two AWS misconfigurations that go beyond the basics of bucket visibility. The first is bucket name squatting, and the second is the cross-service confused deputy problem. Fake scandal clips on Facebook bait victims into investment scams Bitdefender researchers uncovered hundreds of scam campaigns promoted through Facebook ads that use fake news stories, celebrity impersonation, and redirect chains to funnel victims into investment fraud schemes. The activity ran through 310 malvertising campaigns distributed on Meta platforms from February 9 to March 5, 2026. The campaigns generated more than 26,000 ad sightings with localized content in more than 15 languages. 45,000 malicious IP addresses taken down, 94 suspects arrested An international law enforcement operation has taken down more than 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware activity. The action was carried out as part of Operation Synergia III, an investigation that ran from July 18, 2025 to January 31, 2026. Hackers tried to breach Poland’s nuclear research centre Poland’s National Centre for Nuclear Research (NCBJ) thwarted a cyberattack targeting its IT infrastructure. The attempted intrusion was detected and blocked before attackers could compromise systems or disrupt operations. Meta ditches end-to-end encrypted messaging on Instagram End-to-end encrypted messaging on Instagram will no longer be supported after May 8, 2026. Meta justified the move by saying the feature was rarely used, with only a small fraction of Instagram users enabling encryption. The company advised users seeking end-to-end encryption to switch to WhatsApp, where it is enabled by default. Hidden instructions in README files can make AI agents leak data Developers rely on AI coding agents to set up projects, install dependencies, and run commands by following instructions in repository README files, which provide setup guidance for software projects. New research identifies a security risk when attackers hide malicious instructions in those documents. Millions of UK firms on alert after Companies House data exposure Companies House, the UK’s official company registry, said its WebFiling service is back online after being shut down on Friday to fix a security issue that may have exposed the personal data of millions of firms. An investigation indicates the flaw was likely introduced during an October 2025 update. EU sanctions Chinese company behind 65,000-device hack The EU Council has sanctioned companies from China and Iran, along with two individuals, over cyberattacks targeting its member states and partners. With the latest listings, the EU cyber sanctions regime applies to 19 individuals and 7 entities. Global fraud losses climb to $442 billion Online fraud is reaching more victims and generating larger losses, driven by digital tools and organized networks operating across borders. In INTERPOL’s March 2026 Global Financial Fraud Threat Assessment, financial fraud sits among the top five global crime threats, with a 54% rise in fraud related Notices and Diffusions from 2024 to 2025. Big tech companies step in to support the open source security ecosystem Backed by new funding commitments from major technology players, open source security efforts are moving beyond threat identification toward practical solutions for defenders. The Linux Foundation announced $12.5 million in grant funding backed by Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen open source security. Apple starts issuing lightweight security updates between software releases Apple is delivering small security updates, called Background Security Improvements, starting with iOS 26.1, iPadOS 26.1, and macOS 26.1. Apple describes Background Security Improvements as lightweight security releases for components such as Safari, the WebKit framework, and other system libraries, delivered through ongoing patches between software updates. Firefox is getting a free built-in VPN Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past. Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past. Elite members of North Korean society fake their way into Western paychecks Increased federal activity, including indictments over the past year, has drawn attention to a pattern that has been unfolding inside corporate hiring pipelines. North Korean nationals are securing roles as remote IT contractors and full-time staff within organizations across North America and Western Europe, using standard hiring channels to get in. Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults Samba 4.24.0 arrived carrying a set of Kerberos security changes aimed at Active Directory deployments. The release fixes a vulnerability, extends audit coverage for sensitive AD attributes, and introduces configuration options to counter two related Kerberos impersonation techniques. 900,000 contact records exposed in Aura data breach Aura, the online safety service, confirmed that an unauthorized party accessed about 900,000 records, mostly names and email addresses from a marketing tool linked to a company it acquired in 2021. The incident occurred as a result of a targeted phone phishing attack that tricked one of the employees. Secure endpoint management systems immediately, CISA urges The US Cybersecurity and Infrastructure Security Agency (CISA) warns that the cyberattack on Stryker Corporation serves as a signal to U.S. organizations that foreign cyber activity tied to Middle East conflicts may be spilling into their operations. Attackers breached Stryker’s internal Microsoft environment and reportedly wiped 200,000 systems, servers, and mobile devices, while extracting 50 terabytes of data. 4chan shrugs off UK regulator, refuses to pay £520,000 in fines over online safety violations The U.K.’s media regulator Ofcom fined 4chan £450,000 under the Online Safety Act for failing to introduce age checks to stop children from accessing pornographic content on its platform. 4chan is an online forum notorious for its extreme right-wing content, gory videos, and non-consensual pornography. Authorities disrupt four IoT botnets behind record DDoS attacks The U.S. Justice Department and international partners have disrupted four IoT botnets linked to DDoS attacks that reached 30 terabits per second, among the largest ever recorded. The four botnets targeted in the operation—Aisuru, KimWolf, JackSkid and Mossad—infected millions of devices worldwide, primarily IoT systems such as digital video recorders, web cameras and WiFi routers. Terminated contract led to $2.5 million cyber extortion scheme A federal jury convicted Cameron Curry, 27, a Charlotte resident, of carrying out an extensive cyber extortion scheme targeting a Washington, D.C.-based international technology company. He faces up to two years in prison on each of the six charges. VulHunt: Open-source vulnerability detection framework Binarly has published VulHunt Community Edition, making the core scanning engine from Binarly’s commercial Transparency Platform available to independent researchers and practitioners. VulHunt Community Edition is a framework for detecting vulnerabilities in compiled software. It operates against multiple binary representations simultaneously, working across disassembly, an intermediate representation layer, and decompiled code. Targets include POSIX executables and UEFI firmware modules. Microsoft Edge 146 adds IP privacy and local network access controls Microsoft Edge version 146 (Stable) became available on March 13, 2026, bringing updates to tracking protection, IP privacy, and enterprise network security policies. Microsoft zeroes in on AI-driven data risks in Fabric New Microsoft Purview innovations for Microsoft Fabric help organizations secure data and accelerate AI adoption. The updates focus on identifying risks, preventing data oversharing, and strengthening governance and data quality across the data estate. Your APIs are under siege, and attackers are just getting warmed up Internet-facing systems are handling sustained levels of malicious traffic across APIs, web applications, and DDoS channels. Akamai’s State of the Internet security report places these patterns within the same operating environment, with activity increasing across each area through 2025. Betterleaks: Open-source secrets scanner Secrets scanning has become standard practice across engineering organizations, and Gitleaks has been one of the most widely used tools in that space. The author of that project has now released a new tool called Betterleaks, which is designed to scan git repositories, directories, and standard input for leaked credentials, API keys, tokens, and passwords. Java 26 ships with new cryptography API and HTTP/3 support Oracle released JDK 26, the 17th consecutive feature release delivered under the six-month cadence the project adopted in 2018. The release includes ten JDK Enhancement Proposals spanning language changes, garbage collection improvements, cryptographic tooling, and network protocol support. EDR killers are now standard equipment in ransomware attacks Ransomware attackers routinely deploy tools designed to disable endpoint detection and response software before launching encryptors. These tools, known as EDR killers, have become a standard component of ransomware intrusions. ESET Research tracked nearly 90 EDR killers actively used in the wild. Google limits Android accessibility API to curb malware abuse Google is restricting how Android apps can use accessibility features after years of abuse by banking Trojans and mobile malware. The changes, introduced in Android 17.2, limit access to the accessibility API when Advanced Protection Mode (APM) is enabled. Apps that do not serve a core accessibility function can no longer use these services, closing off a common attack vector. Llamafile, Mozilla’s portable LLM runner, gets GPU support and a rebuilt core Running a large language model on a single machine without cloud access or a container runtime remains a priority for practitioners working in air-gapped or resource-constrained environments. Llamafile, Mozilla-AI’s project for packaging and running LLMs as self-contained executables, has received its most significant architectural overhaul to date with version 0.10.0. Fake AI songs streamed billions of times, netting fraudster $10 million Michael Smith, 54, of Cornelius, North Carolina, has pleaded guilty in federal court to running a scheme that exploited music streaming platforms and diverted royalty payments from artists. He admitted to one count of conspiracy to commit wire fraud, which carries a maximum sentence of five years in prison, and agreed to forfeit $8,091,843.64. Google slows Android sideloading to trip up scammers Google’s advanced flow for Android changes how apps from unverified developers are installed, adding steps to reduce scam-driven sideloading. The feature is aimed at experienced users and allows sideloading through a controlled, one-time setup. It addresses scam scenarios where attackers pressure individuals to install malicious software. Cybersecurity jobs available right now: March 17, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: March 20, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Intel 471, Kore.ai, NinjaOne, Pindrop, Secure Code Warrior, Token Security, and Xona Systems.

La sintesi della Sessione Tematica 3, dal titolo “Cybercrime, Crypto Asset e Nuove Tecnologie”, che si è tenuta durante la Conferenza Internazionale CyberSEC2026. Sintesi della Sessione Tematica 3 dal titolo ““Cybercrime, Crypto Asset e Nuove Tecnologie”” durante la quinta edizione della Conferenza Internazionale CyberSEC – Cybercrime e Cyberwar: Norme, Geopolitica e Cybersecurity per una Difesa Comune, promossa e organizzata da Cybersecurity Italia in collaborazione con la Polizia di Stato, tenutasi a Roma presso la Scuola Superiore di Polizia. Mancazzo (Guardia di Finanza): “Assistiamo a un progressivo spostamento degli illeciti dalle piazze fisiche alle piazze virtuali” Crypto-asset e criminalità, ransomware, riciclaggio e darknet markets, istituti bancari, fintech e pagamenti digitali, frodi, crypto e sicurezza dell’economia digitale, intelligenza artificiale (AI), deepfake, frodi automatizzate e social engineering evoluto, sono stati i temi chiave al centro della sessione dal titolo “Cybercrime, crypto asset e nuove tecnologie”, presieduta e moderata da Antonio Mancazzo, Comandante Nucleo Speciale Tutela Privacy e Frodi Tecnologiche della Guardia di Finanza, della 5^ edizione di CyberSEC,la Conferenza internazionale promossa ed organizzata dal quotidiano Cybersecurity Italia, in collaborazione con Polizia di Stato. Nucleo delle Fiamme gialle che oggi è fortemente impegnato su due fronti principali, ha spiegato il Generale Mancazzo: “Da un lato il monitoraggio della rete — e in particolare del deep web — con attività di contrasto ai black market; dall’altro il contrasto all’utilizzo illecito delle criptovalute. Effettuiamo un monitoraggio costante della blockchain e, pur con notevoli sforzi investigativi, riusciamo spesso a de-anonimizzare i soggetti responsabili di determinate operazioni. Tuttavia, ci troviamo di fronte anche a diverse criticità normative e operative, come le modalità di sequestro dei crypto-asset. Non parliamo soltanto di criptovalute, che rappresentano una categoria all’interno del più ampio insieme dei crypto-asset, che comprende anche token, smart contract e altri strumenti digitali”. Le difficoltà “Una delle difficoltà principali è che, ancora oggi, non disponiamo di un Fondo unico di giustizia che consenta, analogamente a quanto avviene per la valuta tradizionale, di depositare immediatamente i beni sequestrati alla criminalità economico-finanziaria. A questo si aggiunge il problema delle tempistiche di conversione dei crypto-asset sottoposti a sequestro. Le criptovalute – ha precisato il Comandante del Nucleo spciale – sono rappresentazioni digitali di valore caratterizzate da fortissima volatilità. Per questo sarebbe opportuno prevedere tempi certi entro i quali procedere alla loro conversione”. “Le difficoltà sono ulteriormente aggravate dal fatto che i tempi della blockchain sono immediati, mentre quelli della cooperazione di polizia e della cooperazione giudiziaria internazionale sono inevitabilmente più lunghi. Le frodi legate ai falsi investimenti online non sono più episodi isolati, ma rappresentano ormai un vero e proprio allarme sociale”. Criminalità e tecnologie La criminalità economico-finanziaria e la criminalità organizzata sfruttano sempre più le tecnologie digitali, ha affermato Mancazzo: “Assistiamo a un progressivo spostamento degli illeciti dalle piazze fisiche alle piazze virtuali. Nei black market, venditori e acquirenti non si conoscono e l’anonimato rappresenta una forma di tutela reciproca. In questi contesti abbiamo riscontrato la vendita di armi, stupefacenti, documenti contraffatti, banconote false e intere liste di dati sottratti a seguito di data breach. Spesso, quando la vittima di un attacco informatico non paga il riscatto, i dati vengono pubblicati sul dark web. Un ulteriore ambito di intervento riguarda la tassazione delle criptovalute. In questo settore registriamo numerosi casi di evasione fiscale, spesso legati alla convinzione che lo pseudo-anonimato della blockchain consenta di sottrarsi agli obblighi fiscali. Su questo fronte, con grande fatica, siamo riusciti a ottenere importanti pronunce della Corte di Cassazione, che hanno chiarito un punto fondamentale: la tassazione delle criptovalute era dovuta anche prima del 1° gennaio 2023, data a partire dalla quale è stata introdotta una disciplina organica della materia”. Dalla Benetta (Protiviti Italia): “Passare dai SOC agli X Operations Center, in cui far confluire tutti i dati rilevanti per la difesa dell’organizzazione” Nicola Dalla Benetta, Director di Protiviti Italia, ha parlato del modello 4×4: “Quattro ostacoli da riconoscere e quattro passi operativi da mettere in sequenza per riuscire ad affrontare efficacemente questi fenomeni. Partiamo dagli ostacoli. Il primo riguarda le complessità e le stratificazioni tecnologiche presenti all’interno delle aziende. Nel tempo le organizzazioni hanno accumulato sistemi, piattaforme, strumenti diversi che spesso convivono senza essere realmente integrati. Il secondo è rappresentato dalle stratificazioni organizzative: ruoli, responsabilità e processi che si sono sovrapposti nel tempo, sia all’interno delle aziende sia, più in generale, nel contesto della società e delle istituzioni. Il terzo ostacolo è la stratificazione culturale e formativa, un tema che è stato richiamato più volte durante la giornata. Parliamo di competenze, linguaggi e approcci professionali differenti che non sempre riescono a dialogare tra loro. Infine c’è la stratificazione regolatoria, cioè un quadro normativo che si è costruito progressivamente nel tempo e che spesso aggiunge ulteriori livelli di complessità. Questi quattro fattori, messi insieme, hanno prodotto un risultato abbastanza evidente: un insieme di contromisure che faticano a lavorare in modo realmente armonico”. I vari processi All’interno delle organizzazioni, ha proseguito Dalla Benetta, si trovano processi diversi: “Antiriciclaggio, gestione delle frodi esterne, gestione delle frodi interne, cyber security. Oggi questi ambiti condividono sempre più elementi, perché la digitalizzazione ha portato a una forte convergenza tra questi fenomeni. Tuttavia, nella pratica, sono ancora gestiti da team diversi, con competenze differenti e spesso anche con difficoltà di comunicazione reciproca. Per questo propongo quattro passi operativi che possono aiutare ad affrontare in modo più efficace queste sfide. Il primo è una governance chiara. All’interno delle organizzazioni bisogna rispondere a domande molto semplici: chi si occupa delle cyber frodi? Chi intercetta questi eventi? E chi li gestisce? Chi li analizza? Chi risponde operativamente? E, soprattutto, quali schemi di cyber fraud vogliamo intercettare? È evidente quindi che questi ambiti non possono più essere trattati come compartimenti separati e analizzati da tre team diversi”. Il secondo passo riguarda i dati, ha affermato Dalla Benetta: “Oggi abbiamo parlato molto di SOC, Security Operations Center, ed è positivo. Ma forse dobbiamo iniziare a guardare allo step successivo: quello che potremmo definire X Operations Center, cioè strutture in cui far confluire progressivamente tutti i dati rilevanti per la difesa dell’organizzazione. Il terzo passaggio riguarda i controlli su questi dati. In questo contesto l’intelligenza artificiale diventa un elemento abilitante fondamentale, perché consente di analizzare grandi volumi di informazioni e individuare schemi e anomalie che altrimenti sarebbero difficili da intercettare. Infine c’è il quarto elemento: i presidi e la formazione. Abbiamo bisogno di competenze verticali molto solide sulle singole materie, ma queste competenze devono essere poi orchestrate in modo orizzontale all’interno dell’organizzazione. Solo così è possibile garantire una gestione davvero efficace di fenomeni complessi come le cyber frodi”. Galvagna (Vectra AI): “Le frodi cyber si combattono con consapevolezza umana e tecnologie avanzate” riguardo all’evoluzione degli attacchi cyber, sempre più numerosi, ma soprattutto sempre più efficaci e pericolosi, Massimiliano Galvagna, Country Manager Italy di Vectra AI, ha invece portato un esempio personale: “Lavoro per un’azienda americana e, fortunatamente, il nostro CEO viene spesso in Italia perché il nostro è un account molto attivo. Proprio per questo motivo sono stato oggetto di un attacco di smishing molto ben costruito. Ho ricevuto un messaggio su WhatsApp apparentemente proveniente dal nostro CEO, con tanto di fotografia del profilo. Il messaggio diceva più o meno: “Dobbiamo incontrarci a breve, chiamami perché ho un problema”. Tutto era credibile: sapevano che era prevista una sua visita in Italia, conoscevano il contesto e il momento. Questo tipo di attacco funziona proprio perché abbassa le nostre soglie di attenzione. Quando riceviamo un messaggio da quello che sembra essere il nostro amministratore delegato, si attivano automaticamente una serie di meccanismi psicologici. Al tavolo precedente si parlava di bias cognitivi, e credo sia un riferimento molto pertinente. In questo caso non parliamo nemmeno di tecnologie particolarmente sofisticate: si tratta semplicemente di un messaggio WhatsApp con una foto. Tuttavia, se a questo aggiungiamo l’intelligenza artificiale nelle mani del cybercrime, è evidente che il livello di sofisticazione degli attacchi può crescere ulteriormente e rendere tutto ancora più complesso”. L’importanza della formazione “Per questo motivo è stato giustamente ricordato, anche questa mattina, quanto sia fondamentale il tema della formazione. Conoscenza, consapevolezza e formazione sono strumenti essenziali – ha continuato Galvagna – perché ci permettono di riconoscere quei piccoli segnali — quei trigger tipici di un attacco — che possono metterci in allerta. È sempre possibile accorgersene? Purtroppo no. Ed è qui che entra in gioco la tecnologia. Noi, come azienda, stiamo lavorando molto sull’analisi comportamentale. In particolare analizziamo tre elementi fondamentali: le credenziali, cioè le utenze che tutti noi utilizziamo; gli asset, che possono essere uno smartphone, un tablet, un computer o un laptop; e infine i servizi utilizzati. Attraverso l’analisi comportamentale di questi tre fattori e grazie all’utilizzo dell’intelligenza artificiale, è possibile individuare le differenze tra un comportamento normale e uno anomalo. Questo può aiutarci a identificare situazioni problematiche: ad esempio il comportamento di un dipendente infedele, oppure quello di una persona che, magari senza rendersene conto, è caduta in un meccanismo di frode”. Le frodi non sono nate con l’informatica “Le frodi non sono nate con l’informatica. Esistevano già prima. La tecnologia ha semplicemente fornito un nuovo vettore, un nuovo mezzo attraverso cui realizzarle. Ed è vero anche che oggi si tratta di attività estremamente remunerative per chi le mette in atto. Anche con tecniche molto semplici — una sorta di “pesca a strascico” digitale — è possibile ottenere risultati economici significativi. Purtroppo questo rende il fenomeno molto diffuso. Detto questo – ha concluso Galvagna – non dobbiamo essere completamente pessimisti. Una via d’uscita esiste: passa certamente attraverso la formazione e il miglioramento dei processi, ma passa anche attraverso l’utilizzo della tecnologia. Oggi è sempre più difficile riconoscere un attacco soltanto grazie all’esperienza personale. Video ben realizzati, messaggi credibili o richieste apparentemente legittime possono risultare molto convincenti. Per questo motivo la combinazione tra consapevolezza umana e strumenti tecnologici avanzati diventa fondamentale per affrontare efficacemente queste minacce”. Tonelli (OPSWAT): “AI come strumento per ottenere in modo rapido informazioni complesse” “Le minacce avanzate, come il ransomware e i cosiddetti ransomware-like, si stanno evolvendo in qualcosa di sempre più difficile da prevenire e gestire. La criminalità informatica non è ancora arrivata al punto in cui l’intelligenza artificiale viene utilizzata in modo completamente autonomo per sviluppare software in grado di causare qualsiasi tipo di danno alla vittima prescelta, ma siamo molto vicini a quel livello. Per il momento, l’AI viene utilizzata dai cybercriminali soprattutto per ottimizzare l’efficacia delle loro attività malevole”, ha spiegato Emilio Tonelli, Senior Solution Engineer di OPSWAT. “Grazie all’intelligenza artificiale – ha aggiunto Tonelli – un criminale può comprendere velocemente, qual è il profilo economico delle vittime. Calibrare attacco e importo del riscatto in modo proporzionale alle reali capacità economiche della vittima, aumentando così le probabilità di successo dell’azione e che il pagamento venga effettivamente effettuato”. Come ottenere velocemente informazioni “L’AI diventa quindi uno strumento per ottenere rapidamente informazioni complesse e mirate. Può essere utilizzata anche da un punto di vista tecnico per creare malware ottimizzati per colpire uno specifico target. Si passa così da un modello di attacco a strascico, più o meno casuale, in cui la vittima non è realmente mirata, a un modello in cui il bersaglio e tecniche di attacco vengono selezionate con precisione”, ha proseguito il Senior Solution Engineer di OPSWAT. Nella cyber kill chain, ha sottolineato Tonelli, “l’intelligenza artificiale ha già un ruolo rilevante nel mondo del cybercrime proprio nella fase di selezione della vittima, individuando chi ha maggiori probabilità di cadere nella trappola di un phishing o di un vishing, cioè il voice phishing. L’AI è in grado di ascoltare e replicare il timbro vocale di una persona, arrivando così a ingannare la vittima in modo estremamente convincente. L’industria (e OPSWAT) si sta muovendo per contrastare questo utilizzo dell’AI, sviluppando soluzioni basate su intelligenza artificiale in grado di rilevare files generati da AI utilizzati dai criminali. Questa attenzione potrà essere utile anche per fornire strumenti alle Forze dell’Ordine e ai cittadini”.

New infosec products of the month: January 2026 Here’s a look at the most interesting products from the past month, featuring releases from Acronis, Booz Allen Hamilton, cside, Descope, JumpCloud, MIND, Noction, Obsidian Security, Rubrik, SEON, SpyCloud, Tenable, Tosi and Vectra AI. Acronis Archival Storage brings compliance-ready, S3-compatible cold storage to MSPs Acronis announced the launch of Acronis Archival Storage, a long-term, compliant, and cost-efficient data storage and protection solution designed for Managed Service Providers (MSPs) and their small-to-medium business (SMBs) customers. With Acronis Archival Storage, users can retain large amounts of data securely, affordably, and with fast accessibility when it matters most. JumpCloud introduces AI features to govern shadow AI and autonomous agents JumpCloud is unveiling new AI capabilities to fuel safe innovation. Organizations can leverage JumpCloud’s platform to accelerate AI adoption. They can ensure compliance and control for all types of identity, human, non-human, and autonomous agents. Noction adds automatic anomaly detection to IRP v4.3 for faster DDoS mitigation Noction has released Noction Intelligent Routing Platform (IRP) v4.3, delivering new capabilities in automated DDoS detection, routing safety, and operational control for modern IP networks. A key highlight of IRP v4.3 is the introduction of Automatic Anomaly Detection (AAD), a new capability designed to identify abnormal traffic behavior and mitigate threats directly at the network edge. SpyCloud launches Supply Chain Threat Protection to expose vendor identity risk SpyCloud has released Supply Chain Threat Protection solution, an advanced layer of defense that expands identity threat protection across the extended workforce, including organizations’ entire vendor ecosystems. SpyCloud Supply Chain Threat Protection provides timely access to identity threats derived from billions of recaptured breach, malware, phished, and combolist data assets, empowering organizations, from enterprise security teams to public sector agencies, to act on credible threats rather than simply observe and accept risk. cside targets hidden website privacy violations with Privacy Watch cside announced the launch of Privacy Watch. The platform prevents website privacy violations on the client-side, a risk surface that is traditionally unmonitored. To help organizations automate compliance with regulations like GDPR, CPRA, and HIPAA, Privacy Watch deploys AI for continuous website risk monitoring, evidence logs, and regulation-specific reports. Obsidian Security unveils end-to-end SaaS supply chain security to stop integration-led breaches Obsidian Security is launching a new solution that secures the SaaS supply chain across its full lifecycle, bringing together integration risk visibility, proactive prevention, early breach detection and impact forensics, all in a single, unified platform. Rubrik introduces Security Cloud Sovereign for data sovereignty and regulatory compliance Rubrik announced Rubrik Security Cloud Sovereign, an offering that gives global organizations control over their data to support national security and operational continuity. Rubrik Security Cloud Sovereign gives customers the ability to maintain control over where data resides and who has access to it as regulations change. SEON Identity Verification combines KYC checks with real-time fraud intelligence SEON has unveiled the launch of its AI-powered Identity Verification solution, bringing ID verification, liveness detection and proof of address checks into its unified risk platform. The solution supports identity document verification for global government-issued IDs, biometric liveness checks, proof of address verification and optional government database checks. Vectra AI helps organizations prevent AI-powered cyberattacks Vectra AI’s next-generation platform introduces three distinct enhancements, each designed to deliver a specific outcome across the AI attack lifecycle: preemptive security to reduce exposure, proactive defense to stop attacks as they start, and accelerated response to contain attacks while they are in motion. Booz Allen’s Vellox Reverser accelerates malware analysis and threat intelligence Booz Allen Hamilton announced the general availability of Vellox Reverser, a malware reverse engineering and threat intelligence product designed to accelerate cyber defense. Built with a resilient agentic AI architecture, Vellox Reverser automates time-intensive in-depth malware analysis of the most complex and evasive threats. Descope introduces dedicated identity infrastructure for AI agents and MCP ecosystems Descope has updated its Agentic Identity Hub to provide MCP developers and AI agent builders with standards-based identity infrastructure for their AI systems. Organizations can now use Descope to manage AI agents as first-class identities alongside human users, add OAuth 2.1 and tool-level scopes to their internal and external MCP servers, and govern agent access to MCP servers with enterprise-grade policy enforcement. Dedicated agentic identity management (Source: Descope) Tenable One AI Exposure delivers unified visibility and governance across AI, cloud and SaaS Tenable announced general availability of Tenable One AI Exposure. With this release, the Tenable One Exposure Management Platform unifies AI protection, discovery and usage governance across the enterprise, including SaaS platforms, cloud services, APIs and agents. MIND DLP for Agentic AI protects sensitive data and controls AI access MIND announced DLP for Agentic AI, a data-centric approach to AI security designed to help organizations safely achieve the business value of agentic AI by ensuring sensitive data and AI systems interact safely and responsibly. Tosi Platform delivers unified connectivity, visibility, and security for OT at scale Tosi customers worldwide gain access to the Tosi Platform, which unifies connectivity, visibility, and security across operational technology environments in every industry, regardless of size or complexity. At the heart of the platform is Tosi Control, a cloud-based console that enables OT and security teams to connect remote sites, monitor critical assets, and manage access, all in real time and without requiring extensive IT resources.

New infosec products of the week: January 23, 2026 Here’s a look at the most interesting products from the past week, featuring releases from cside, Obsidian Security, Rubrik, SEON, and Vectra AI. cside targets hidden website privacy violations with Privacy Watch cside announced the launch of Privacy Watch. The platform prevents website privacy violations on the client-side, a risk surface that is traditionally unmonitored. To help organizations automate compliance with regulations like GDPR, CPRA, and HIPAA, Privacy Watch deploys AI for continuous website risk monitoring, evidence logs, and regulation-specific reports. Obsidian Security unveils end-to-end SaaS supply chain security to stop integration-led breaches Obsidian Security is launching a new solution that secures the SaaS supply chain across its full lifecycle, bringing together integration risk visibility, proactive prevention, early breach detection and impact forensics, all in a single, unified platform. Rubrik introduces Security Cloud Sovereign for data sovereignty and regulatory compliance Rubrik announced Rubrik Security Cloud Sovereign, an offering that gives global organizations control over their data to support national security and operational continuity. Rubrik Security Cloud Sovereign gives customers the ability to maintain control over where data resides and who has access to it as regulations change. SEON Identity Verification combines KYC checks with real-time fraud intelligence SEON has unveiled the launch of its AI-powered Identity Verification solution, bringing ID verification, liveness detection and proof of address checks into its unified risk platform. The solution supports identity document verification for global government-issued IDs, biometric liveness checks, proof of address verification and optional government database checks. Vectra AI helps organizations prevent AI-powered cyberattacks Vectra AI’s next-generation platform introduces three distinct enhancements, each designed to deliver a specific outcome across the AI attack lifecycle: preemptive security to reduce exposure, proactive defense to stop attacks as they start, and accelerated response to contain attacks while they are in motion.

Vectra AI helps organizations prevent AI-powered cyberattacks Vectra AI launched the next generation of its flagship platform, purpose-built to protect the AI enterprise by delivering preemptive security and proactive defense against AI-powered cyberattacks. As enterprises embed AI across applications and infrastructure, they are becoming AI enterprises: always-on, hyper-connected environments that operate at machine speed. These environments function as a single, living network spanning on-premises data centers, multi-cloud, identity, SaaS, IoT/OT, edge, and AI infrastructure, where non-human identities and AI agents increasingly outnumber people, and activity never stops. In this environment, identity defines how the AI enterprise operates, governing access, automation, and the paths attackers exploit. At the same time, adversaries are weaponizing AI to abuse identity, automate reconnaissance, establish command and control, and move laterally faster than traditional security controls can respond. In the AI enterprise, attackers don’t break in; they log in, exploit trust, and blend in with legitimate behavior. “Modern networks have fundamentally changed the physics of cyber risk,” said Hitesh Sheth, CEO of Vectra AI. “They are the nervous system of the AI enterprise, where identities act and data moves at machine speed. Attackers understand this and are exploiting it. With our next-generation platform, Vectra AI is redefining cyber resilience by giving defenders continuous visibility, clear AI-driven signal, and answers at machine speed to stop AI-powered attacks long before they disrupt the business.” Vectra AI’s next-generation platform introduces three distinct enhancements, each designed to deliver a specific outcome across the AI attack lifecycle: preemptive security to reduce exposure, proactive defense to stop attacks as they start, and accelerated response to contain attacks while they are in motion. Unified observability: Enabling preemptive security Vectra AI delivers unified observability across the entire AI enterprise, spanning on-premises data centers, multi-cloud, identity, SaaS, IoT/OT, edge, and AI infrastructure. By combining flow-based scale with packet-level context, the platform provides both breadth and depth of visibility across one enterprise-wide attack surface. This unified observability enables preemptive security by allowing security teams to identify and reduce exposure before AI-powered attackers can exploit identities, trust relationships, and automate paths. By seeing how systems and identities behave across the network, organizations can close gaps and reduce risk before attacks begin. “AI infrastructure no longer behaves like a traditional network,” said Marty Roesch, Head of Cloud at Vectra AI. “Traffic is ephemeral, east–west dominates, and the most important activity never crosses a perimeter. To build real resilience in AI environments, security teams need observability that is software-defined and operates at scale without sacrificing fidelity. That is the foundation required to detect and stop AI-driven attacks in real time.” Discover and hunt for AI agents: Powering proactive defense As AI agents become first-class enterprise identities and increasingly powerful tools for attackers, Vectra AI automatically discovers and tracks them across the network. The platform detects when attackers use and abuse AI agents to accelerate reconnaissance, lateral movement, and data access. Pre-built, behavior-based hunts deliver results in seconds, turning threat hunting into a continuous, proactive practice. Detect and investigate AI agent behaviors: Accelerating containment at machine speed Vectra AI removes latency where it matters most: how quickly defenders get answers. By correlating and prioritizing activity based on the speed and progression of attack behavior, Vectra AI enables proactive defense—stopping AI-powered attacks the moment they start, before lateral movement reaches critical systems and data. With the Vectra AI Assistant, analysts can ask natural investigative questions and receive immediate, contextual answers without complex queries or manual analysis. Together, these capabilities accelerate investigation and decision-making, enabling security teams to rapidly understand the scope, progression, and impact of attacks, and contain threats while they are still in motion. “AI agents are now first-class identities in the enterprise—and increasingly, a powerful tool for attackers,” said Snehal Patel, CPO at Vectra AI. “Vectra AI uniquely discovers and tracks AI agents across the modern network, enabling preemptive security by reducing exposure before attackers can exploit it, and proactive defense by detecting and stopping AI-powered attacks the moment they start. With AI-assisted investigations and behavior-based hunts delivering answers in seconds, we remove defender latency so attacks are contained before they spread to critical systems and data.” Cyber resilience, built for AI speed Vectra AI’s next-generation flagship platform represents a decisive break from security models designed for a slower, perimeter-based world. In an era where AI-powered enterprises face AI-powered adversaries, cyber resilience must be continuous, behavior-driven, and capable of responding at machine speed. By grounding resilience in unified observability, behavioral AI, and real-time investigations, Vectra AI enables organizations to deliver preemptive security that reduces exposure before compromise and proactive defense that stops AI-powered attacks the moment they begin. This is cyber resilience built for environments where both innovation and risk now move at AI speed.

Vectra AI redefines hybrid resilience across the attack lifecycle Vectra AI redefines hybrid attack resilience across the full attack lifecycle by unifying controls pre-and-post compromise within the Vectra AI Platform. Vectra AI’s control philosophy empowers defenders with continuous control through proactive threat exposure management, 360 degree response, and posture reporting. The Vectra AI Platform gives security teams consistent, measurable control across the full hybrid attack lifecycle, from eliminating attack exposures before compromise, to executing decisive response actions as active attacks unfold, to proving resilience after attacks are contained. A new operating model for hybrid defense This level of control is increasingly essential as hybrid environments introduce new layers of operational complexity and challenge resiliency pre-and-post compromise. Hybrid enterprises face fragmented visibility, overwhelming alert noise, and mounting pressure to prove their resilience to leadership and regulators. The result is an environment where small exposures can quickly escalate into full-scale incidents. Existing tools operate in silos, forcing defenders into a reactive posture where critical gaps go unaddressed. Vectra AI’s approach to control solves these challenges by unifying visibility, investigation, containment, and resilience reporting across data centers, identity, multi-cloud, SaaS, and IoT/OT environments. This creates a continuous control model that enables security teams to take decisive action before threats emerge, respond faster during active compromise, and validate resilience after incidents, ensuring leadership can verify real improvements in posture and maturity. “Security teams today are drowning in complexity, scattered signals, and tools that don’t talk to each other,” said Mark Wojtasiak, SVP of Research and Strategy at Vectra AI. “We’ve redefined the way defenders control modern attacks proactively within the Vectra AI platform. It’s all about giving defenders complete control across the entire hybrid attack lifecycle. This is the operating model that modern security demands, one where teams identify exposures earlier, respond faster, and deliver and prove the hybrid enterprise resilience.” The three most critical components Vectra AI’s approach to control is built around three interconnected components: proactive threat exposure management, 360 response, and value reporting. Proactive threat exposure management helps security teams identify and address weaknesses before attackers can exploit them. 360-degree response delivers automated containment across host, identity, and network environments, helping defenders act quickly during active compromise. Value reporting provides the operational and executive-level insight needed to reduce exposure, improve posture and demonstrate resilience both pre-and-post compromise. Industry-defining differentiation Vectra AI platform provides: A cohesive control framework spanning the entire hybrid attack lifecycle. Automated host, account, and traffic containment. Continuous exposure discovery across the entire hybrid network. Executive-ready value reporting that proves resilience and maturity. Managed detection and response (MDR) aligned to the control model. This evolution builds directly on Vectra AI’s existing strengths in hybrid network detection and response (NDR) across data center, campus, remote, identity, multi-cloud, SaaS and IoT/OT infrastructure, unified into a single platform experience.

Vectra AI unifies threat visibility across Microsoft environments Vectra AI announced Vectra AI Shield for Microsoft, a purpose-built solution that enables channel partners and MSSPs to deliver unified visibility and control across Microsoft Entra ID, Microsoft 365, Copilot for M365, and Azure Cloud in a single AI-powered platform. Closing the Microsoft visibility gap While Microsoft’s native tools provide broad coverage, many organizations — and the partners that protect them — still face blind spots across hybrid and identity-based attacks. Fragmented products, inconsistent alerts, and complex integrations can slow detection and response, making it harder for partners to deliver efficient and verifiable security outcomes. Vectra AI Shield for Microsoft, powered by Vectra AI’s attack signal intelligence, eliminates these barriers by consolidating AI-driven detection, prioritization, and automated response across the Microsoft ecosystem. The result is simplified operations, faster investigations, and consistent protection that partners can scale confidently across customers and environments. “Security teams and partners don’t need more alerts — they need clarity and control,” said Mark Wojtasiak, Vice President of Research and Strategy at Vectra AI. “Vectra AI Shield for Microsoft extends our attack signal intelligence across the entire Microsoft ecosystem, turning overwhelming signal noise into actionable insight. It’s about helping partners and customers stay one step ahead of attackers while demonstrating effectiveness in every engagement.” According to IDC research, organizations using Vectra AI identify 52% more potential threats and achieve 40% greater SOC efficiency, giving partners measurable proof of value as they expand their Microsoft security offerings. “Organizations often underestimate the prevalence of multi-domain attacks until we demonstrate them firsthand,” said Sébastien Wojcicki, Head of Operations & Security Excellence at Advens. “By running simulations such as golden HTML attacks, we can show how Vectra AI consistently detects these sophisticated, cross-domain threats that Microsoft tools often miss. With a unified view across M365 and on-prem environments, our teams can now investigate threats faster and with greater accuracy.” Key capabilities of Vectra AI Shield for Microsoft: 100+ AI-driven detections and patented Privilege Access Analytics for precise threat identification AI Agents that automate threat triage, correlation, and prioritization Predictable pricing Integrates with Microsoft Sentinel and Defender for Endpoint Together, these capabilities reduce alert noise, accelerate response, and demonstrate verifiable protection outcomes across identity, SaaS, and cloud – enabling channel and MSSPs to deliver complete Microsoft security with speed, clarity, and confidence. Availability Vectra AI Shield for Microsoft is now generally available as a single SKU for channel partners and MSSPs.

Many companies are showcasing their cybersecurity products and services this week at the 2025 edition of the Black Hat conference in Las Vegas. To help cut through the clutter, the SecurityWeek team is publishing a digest summarizing some of the announcements made by vendors at Black Hat USA 2025, including new products and services, updates to existing offerings, reports, and other initiatives. This is the fourth and final roundup. You can also check out the first, second and third part. Abnormal AI updates security posture management product Human behavior security firm Abnormal AI has expanded its continuous security posture management solution to cover Microsoft 365 environments. The add-on continuously detects misconfigurations across users, apps, and tenants, and helps organizations prioritize issues and provides them with remediation guidance. Black Kite launches Adversary Susceptibility Index (ASI) Third-party risk intelligence firm Black Kite has launched Adversary Susceptibility Index (ASI), a product designed to help risk management teams identify which vendors in their ecosystem are most vulnerable to specific threat actors. Capabilities include threat actor intelligence for suppliers, vendor sorting by susceptibility, industry and geography-aware risk, and proactive vendor engagement. CalypsoAI unveils upgraded solutions CalypsoAI, which uses ‘agentic warfare’ to test and secure AI applications, has announced upgraded versions of its Inference Defend and Red-Team solutions. Red-Team now incorporates Agentic Fingerprints, a feature that gives customers observability into how attack agents behave. Defend now includes Outcome Analysis, a new feature that provides clear visibility into why prompts and responses are flagged or blocked. CyberProof enhances Exposure & Defense Management capabilities CyberProof has rolled out enhancements to its Exposure & Defense Management capabilities and announced the introduction of cyber asset Estate Management. The new threat-led defense capabilities enable organizations to prioritize threats and risks more effectively, and optimize defenses for faster response. Estate Management is a capability that gives organizations the ability to streamline the discovery of all assets across hybrid environments. Drata unveils AI agent for vendor risk management Drata has introduced an AI agent for vendor risk management, aimed at transforming how security and GRC teams manage trust. Drata leverages AI to create dynamic, autonomous trust management that adapts in real time and delivers ongoing validation of security, compliance, and risk. Fenix24 publishes report on law firm cybersecurity Fenix24 and the International Legal Technology Association (ILTA) have released their latest joint report, Security at Issue: 2025 State of Cybersecurity in Law Firms. The report offers a deep dive into the current cybersecurity practices, gaps, and risks facing legal organizations. A survey showed that phishing is the main concern in this sector, cited by 50% of respondents. The report’s key findings also focus on backups, MFA, security confidence, external assessments, and major weaknesses. HPE expands cybersecurity, resiliency and compliance solutions HPE has expanded its cybersecurity, resiliency and compliance solutions as part of its Aruba and Juniper secure networking portfolio. The company has advanced network security with a new SASE copilot for HPE Aruba Networking EdgeConnect. In addition, HPE Aruba Networking Central NAC expands zero trust policy enforcement to HPE Juniper Networking and third-party devices. HPE also unveiled the Alletra Storage MP X10000 data protection solution, and HPE Zerto Software, which offers a new integration hub to enable third-party applications to access HPE Zerto data. CrowdStrike is the exclusive integration launch partner. Minimus product enhancements Secure container images provider Minimus announced new product enhancements, including integrated Vulnerability Exploitability eXchange (VEX) support, new compliance dashboards and views, hardened helm charts for security deployment, and integration with Microsoft for Single Sign-On (SSO). Pentera adds new attack surface testing capabilities Automated security validation firm Pentera has launched AI-powered Web Attack Surface Testing, featuring AI-driven payload generation and adaptive testing logic to emulate sophisticated threats. The addition will enable more context-aware and adaptive attack emulation, helping security teams validate their abilities against AI-assisted threats. Push Security introduces Phishing Detection Evasion Techniques matrix Browser-based detection and response firm Push Security has published a Phishing Detection Evasion Techniques matrix, a resource designed to help security teams visualize and counter real-world identity threats by mapping TTPs across every phase of the phishing lifecycle, and providing real-world examples. RedSeal announces new products Exposure management firm RedSeal launched Risk Radius, a risk prioritization and impact analysis solution designed to help security teams identify and remediate dangerous exposures. The company also unveiled RedSeal One, an AI-enabled exposure management platform designed to help organizations reduce risk, streamline operations, and strengthen resilience across hybrid environments. Sophos partners with Halcyon and Rubrik Sophos announced a partnership with Halcyon for real-time threat intelligence sharing and implementation of anti-tamper protections so each platform can monitor and safeguard customers against ransomware. Sophos also announced a partnership with Rubrik to create an MDR-optimized Microsoft 365 backup and recovery solution. Sophos said these partnerships will enable greater resiliency to stop attacks in progress and accelerate recovery when an attack occurs. SpyCloud enhances investigations platform SpyCloud rolled out an AI-powered upgrade to its investigations platform. The new tool mirrors the tradecraft of elite cyber investigators, helping security and fraud teams automate and accelerate complex cybercrime investigations to surface insider threats. It rapidly correlates breach, malware, and phishing data with behavioral signals from infected devices, generating finished intelligence in seconds. Sysdig launches agentic cloud security platform Sysdig launched an agentic cloud security platform that leverages autonomous AI agents to analyze cloud environments for risks and threats. A fully integrated AI cloud security analyst named Sysdig Sage understands context from the entire business and provides contextual remediation recommendations. Tenable unveils new solution for securing enterprise AI Tenable announced a major expansion of its exposure management platform to secure the risks introduced by generative AI in the enterprise. Tenable AI Exposure is a comprehensive solution that provides an end-to-end approach to see, manage, and control the risks introduced by generative AI. The solution’s capabilities include comprehensive AI discovery, AI exposure management, and governance and control. Tuskira upgrades Agentic AI Workforce Autonomous security operations platform Tuskira has enhanced its Agentic AI Workforce, adding AI-powered threat investigation, preemptive remediation and response, application-aware defense, and an upgraded simulation engine. Vanta announces partnership with XBOW Vanta announced a partnership with XBOW to bring autonomous AI pentesting directly to its platform. The new capabilities enable organizations to run automated penetration tests without the need for outside consultants, and launch and complete tests directly within Vanta’s platform, streamlining testing into existing security and compliance workflows. Vectra AI launches MCP server Vectra AI has launched a Model Context Protocol (MCP) Server, which is available as early access for all customers. MCP enables integration between AI agents and other applications, and Vectra says its MCP server makes it easier for security teams to investigate threats and take action. Zimperium publishes report on mobile infostealers Zimperium has published a new report on mobile infostealers. The report focuses on five malware families: TriaStealer, TrickMo, AppLite, Triada, and SMS Stealer. The company found over 2,400 variants across 69 countries, with Southeast Asia identified as a major hotspot for infections. The most impacted industries were finance, retail, and software.