Geek-Guy.com

Tag: operations

DOD wants to integrate cyber in all operations, and integrate security into AI

The Pentagon is focusing on integrating cyber into all its operations, and wants to make sure it integrates security into artificial intelligence usage from the outset, the Defense Department’s top cyber policy official said Tuesday. Recent conflicts have made clear how important cyber is, said Katherine Sutton, assistant secretary for cyber policy and principal cyber…

Qevlar’s new AI agents correlate CVEs, incident data, and active exploitation signals

Qevlar has announced a new set of AI agents designed to bridge the disconnect between Security Operations Centers (SOCs) and vulnerability management teams. The new capabilities help security teams correlate CVEs with live incident data for real-time risk prioritization, automatically identify asset owners to speed remediation, and autonomously hunt for active CVE exploitation. General availability…

The NSA, ‘Mythos’ and the quiet emergence of AI cyber doctrine

For most of my career running security operations, the shape of cyber conflict has been defined by who could move faster than the other side. Faster at identifying a vulnerability, faster at patching, faster at detecting, faster at responding. The last few months have made me reevaluate that framing. Speed still matters. It just no…

Conifers rolls out AI-powered SOC for unified security operations and automated response

Conifers has announced the launch of its agentic SOC, a unified AI platform designed to help security operations centers defend against cyber adversaries operating at machine speed. Built on the company’s CognitiveSOC platform, the new system connects threat intelligence, threat hunting, detection engineering, investigation, and remediation into a single operating framework grounded in each customer’s…

Riverbed introduces new Aternity tools for autonomous IT operations

Riverbed has announced new capabilities for Aternity designed to support autonomous IT operations for digital experience management. The updates help digital workplace teams move toward prevention-focused operations through broader visibility, context-aware intelligence, and governance controls that support automated workflows. Organizations are measured by their ability to deliver frictionless digital experiences that keep employees productive and…

Westcon-Comstor Launches White-Label OneSOC Service

Westcon-Comstor has launched OneSOC, a vendor-agnostic, white-label security operations service designed to help channel partners offer SOC capabilities under their own brand without upfront investment. The global technology distributor, which specializes in cybersecurity, networking, and hybrid cloud, announced the service on May 19.  OneSOC targets partner barriers to SOC delivery OneSOC is available across Europe,…

MY TAKE: AI agents force a rethink of enterprise service lines as vendors move up the tech tack

ORLANDO — Companies are pulling AI agents into their daily operations through a dozen side doors. Related: SaaS and AI agents converge One of them was in focus at KB4-CON, KnowBe4’s annual customer conference at the Marriott World Center here last week. The Clearwater, Fla.-based cybersecurity training vendor used the conference to lay out a…

Secure, Fast, Reliable: The Best Cloud Storage Providers for Businesses in 2026

This guide is for IT leaders, business owners, and operations teams looking to improve data security, collaboration, and file management in 2026. It covers the best cloud storage providers for businesses and the key features to consider when selecting a secure, scalable, and reliable storage solution. Key Points of Our 2026 Cloud Storage Provider Evaluation…

Q&A: AI Ushers in a New Era in MSP Service Efficiency

The managed services industry is under increasing pressure to scale operations, improve response times, and maintain profitability without continuously adding headcount. For many MSPs, the challenge lies in the operational burden that is created by workflows that still depend heavily on human coordination at nearly every stage of the service desk process. According to Mark…

Xurrent Intros MCP Server to Enhance AI Integration for ITOps

AI-powered service and operations management platform for corporate IT teams and enterprise MSPs, Xurrent, is launching its Model Context Protocol (MCP) server. This MCP standard enables Xurrent to act as a universal connector, enabling different AI models and digital agents to securely access Xurrent data and perform tasks within established workflows. AI models now connect…

How Inefficient MSP Service Desks Drive Burnout

As MSP service desk operations become increasingly complex, inefficiency has emerged as a major contributor to technician burnout. Fragmented ticketing systems, overloaded inboxes, and overly complex workflows can demoralize teams and ultimately lead to burnout. At the same time, MSP teams are managing growing ticket volumes and alert fatigue as businesses become more interconnected and…

One Missed Threat Per Week: What 25M Alerts Reveal About Low-Severity Risk

The dark secret of enterprise security operations is that defenders have quietly institutionalized the practice of not looking. This is not just anecdotal, but rather backed by a recent report investigating more than 25 million security alerts, including informational and low-severity, across live enterprise environments.  The dataset behind these findings includes 10 million monitored

Avantra’s new AI can diagnose SAP failures in seconds

Avantra launched Avantra 26, an advancement in AI-driven operations, strengthening native integration with SAP Cloud ALM, and delivering automated visibility across SAP Business Technology Platform (BTP). Avantra also announced Avantra AIR Root Cause Analyzer, an AI-powered intelligence engine that automatically investigates SAP incidents and surfaces a structured diagnosis the moment an issue is detected. Available…

AI, Cyberwarfare, and Autonomous Weapons: Inside America’s New Military Strategy

The Pentagon is integrating AI into military operations, transforming cybersecurity, targeting, and command systems into a unified warfare architecture. May 2026 marks a turning point in the evolution of modern warfare: the convergence of artificial intelligence, cybersecurity, and conventional military power is no longer theoretical. It is becoming an operational reality. The Pentagon has signed…

The metrics killing your SOC, and what to use instead

Security operations centres risk being rendered entirely ineffective if organizations measure them using the wrong performance indicators, according to Dave Chismon, CTO for Architecture at UK’s National Cyber Security Centre. Ticket-based metrics miss the point Evaluating ones’ SOC using the same ticket-based metrics applied to IT service desks can actively work against its core purpose:…

25 open-source cybersecurity tools that don’t care about your budget

Regardless of the operating system you use, managing secrets, apps, cloud, compliance, and security operations can be overwhelming. The free, open-source tools presented in this article can help you detect threats, increase visibility, enforce controls, and investigate and respond to incidents throughout the development and operational lifecycle. Allama: Open-source AI security automation Allama is an…

Ivanti Neurons AI automates IT operations, reducing manual work and security risk

Ivanti has revealed new solution capabilities, focusing on enabling autonomous IT operations and organizations to secure their environments more efficiently at scale. With these advancements, Ivanti enables IT and security operations to detect, decide, and act autonomously without sacrificing trust, governance, or control. AI capabilities and the threat landscape are changing quickly, and IT and…

Kyrgyzstan-based crypto exchange Grinex shuts down after $13.7M cyber heist, blames Western Intelligence

Grinex halted operations after a $13.7M hack, blaming Western intelligence. Stolen funds came from wallets of Russian users on the platform. Kyrgyz crypto exchange Grinex halted operations after a threat actor stole $13.7 million in a cyber attack that the company attributes to Western intelligence agencies. The stolen funds belonged to Russian users, as the…

Space Force official touts AI’s impact on cyber compliance

Seth Whitworth, who is both acting Associate Deputy Chief of Space Operations for Cyber and Data and acting chief information security officer, said he believes AI tools are shifting the way defenders review cyber risk, both for individual systems and more holistically throughout an enterprise.   In particular, Large Language Models can be used to systematically…

TekStream CEO on Expanding Student-Staffed SOCs Nationwide

TekStream is expanding its student-staffed security operations center (SOC) program nationwide, positioning the model as a dual solution to cybersecurity talent shortages and rising demand for U.S.-based managed security services. We spoke with TekStream CEO Rob Jensen about how the provider continues to build on the program’s early success with LSU. Inside TekStream’s public-private SOC…

Prompt injection tags along as GenAI enters daily government use

Routine use of GenAI has moved into daily operations in state and territorial government environments, placing new security risks within common workflows. A Center for Internet Security (CIS) report, Prompt Injections: The Inherent Threat to Generative AI, identifies prompt injection as a persistent concern tied to that adoption. Adoption expands exposure Use of AI tools…

10 ChatGPT Prompts L1 SOC Analysts Can Use in Their Daily Work

Security operations center (SOC) analysts are expected to process a constant stream of alerts — often under tight response timelines.  At the same time, they are expected to investigate accurately, document clearly, and communicate findings to both technical and non-technical stakeholders. This is where generative artificial intelligence (GenAI) tools such as ChatGPT can be helpful.…

Hasbro hit by cyberattack, investigates possible data breach

Hasbro suffers a cyberattack, disrupting some operations; the company is probing the scope and potential data compromise. Toy giant Hasbro reported a cyberattack on Wednesday that disrupted certain company operations. The firm is investigating the full extent of the incident, including whether any files or sensitive data were compromised, as it works to restore normal…

FIRESIDE CHAT: AI gives rise to a semantic attack surface, forcing a new class of network defense

SAN FRANCISCO — Enterprises rushing to deploy AI in their operations are opening a security exposure most of their existing tools were never designed to address. That’s the hard message coming out of RSAC 2026 — and it’s one worth sitting with. Related: RSAC 2026 recap—no easy AI fixes Jamison Utter, A10 Networks field CISO,…

We Are At War

Rising geopolitical tensions are reflected (or in some cases preceded) by cyber operations, while technology itself has become politicized. Let’s admit it: we are in the middle of it.  Introduction: One tech power to rule them all is a thing of the past  The relative safety, peace and prosperity that much of the world has…

AI SOC vendors are selling a future that production deployments haven’t reached yet

Vendors selling AI-powered security operations platforms have built their pitches around a consistent set of promises: autonomous threat investigation, dramatic reductions in analyst workload, and an accelerating path toward humanless operations. Practitioners buying and deploying those platforms describe something different. A report by Anton Chuvakin, Security Advisor at Google Cloud’s Office of the CISO, and…

Telemetry Pipeline: How It Works and Why It Matters in 2026

A telemetry pipeline has become a core layer in modern security operations because teams no longer send data from applications, infrastructure, and cloud services straight into a single backend and hope for the best. In 2026, most environments are distributed across cloud, hybrid, and on-prem systems, which means more services, more data sources, more formats,…

HPE enhances security to support AI and distributed enterprise environments

HPE has unveiled new security innovations designed to help organizations scale distributed operations, reduce cyber risk, and maintain consistent governance as AI adoption accelerates across the enterprise. To help enterprises securely adopt AI and turn resilience into a core business capability, HPE is introducing the HPE Juniper Networking SRX400 Series Firewalls, an expanded hybrid mesh…

AiStrike cuts alert noise with Continuous Detection Engineering

AiStrike has launched Continuous Detection Engineering, a capability that transforms how security operations teams manage detections, shifting from reactive alert triage to proactive, intelligence-driven optimization. The detection quality gap Security teams today are overwhelmed by alerts, but the root cause is not volume, it’s detection quality. AiStrike’s analysis across enterprise environments revealed that: More than…

Coro automates security operations with end-to-end threat detection and response

Coro has expanded AI-driven security operations capabilities that automate the full lifecycle of threat detection and response, enabling organizations to identify, investigate, and remediate security incidents without manual intervention. The announcement builds on Coro’s intrinsic use of AI across its platform and introduces deeper automation across security workflows, including cross-module response actions and SOC-level task…

Canada-Based Organization Health Shared Services Accelerates SOC Investigations with ANY.RUN 

ANY.RUN spoke with the Interim CISO and Director of Cyber Operations at Health Shared Services, who provided insights into how their team addressed alert fatigue, improved MTTD and MTTR, and strengthened their investigation workflow with ANY.RUN.  In this new addition to our success story series, we explore how the healthcare organization’s SOC team improved detection, triage, and response efficiency while maintaining the existing operational processes.  Organization Overview  Health Shared Services is a healthcare support organization based in Alberta, Canada.  Its SOC team consists of 16…

Canada-Based Organization Health Shared Services Accelerates SOC Investigations with ANY.RUN 

ANY.RUN spoke with the Interim CISO and Director of Cyber Operations at Health Shared Services, who provided insights into how their team addressed alert fatigue, improved MTTD and MTTR, and strengthened their investigation workflow with ANY.RUN.  In this new addition to our success story series, we explore how the healthcare organization’s SOC team improved detection, triage, and response efficiency while maintaining the existing operational processes.  Organization Overview  Health Shared Services is a healthcare support organization based in Alberta, Canada.  Its SOC team consists of 16…

Product showcase: Cross-platform and third-party endpoint patching with Action1

Keeping endpoints patched is one of the more annoying chores in IT operations. Action1 is a cloud-based autonomous endpoint management platform that addresses this challenge head-on, covering third-party apps and OS updates (Windows, macOS, and now Linux) from a single, centralized console. Built as a SaaS solution, it requires no on-premises infrastructure, no VPN tunnels,…

Torq Introduces New Agentic Builder for SOC Workflows

Torq, an agentic security operations leader, has announced the debut of Agentic Builder, which turns human intent into agentic outcomes. Delivering production-grade agentic workflows An extension of the Torq AI SOC Platform, the Builder enables SOCs to shift the cognitive load of engineering security automation from humans to machines.  The Agentic Builder delivers Cursor-level capabilities…

Corelight’s Agentic Triage turns SOC alerts into evidence-backed investigations

Corelight has introduced a new set of agentic AI capabilities aimed at helping security operations centers (SOCs) cut down on repetitive, time-consuming tasks. The updates are designed to boost analyst efficiency, speed up response times, and build trust through greater transparency. The release includes Agentic Triage to streamline SOC workflows, a new suite of machine…

How to Reduce MTTR in Your SOC with Better Threat Intelligence

MTTR is where strategy meets reality. In security operations, it is the margin between a contained incident and a catastrophic breach.  You can have perfect detection coverage, cutting-edge telemetry, and a wall of dashboards glowing like a spaceship cockpit. But if your team takes too long to respond, the attacker still wins the clock. Reducing Mean Time to Respond is not about shaving seconds for vanity metrics. It is about compressing the window in which damage happens. And the fastest way to do that is not more alerts, but better intelligence.  Key Takeaways  MTTR is…

Blumira Intros EDR and ITDR Solutions, Joins Pax8 Marketplace

Blumira, a security operations platform, is releasing enhanced endpoint detection and response (EDR) and identity threat detection and response (ITDR) capabilities. The company also recently joined the Pax8 Marketplace to deliver enterprise security operations to MSPs. Stopping threats at speed These newly expanded capabilities will enable security teams on Blumira Respond and Automate editions to…

Building Trust in AI SOC Analyst Solutions: A UK and EU CISO Perspective

By Brett Candon, VP International at Dropzone AI Trust has always been critical in security operations, but in the UK and Europe it carries significant regulatory weight. GDPR, NIS2 and similar related data‑protection frameworks shape far more than legal risk, they directly influence architectural decisions, supplier selection, and how security data can be accessed, processed…

Binary Defense’s NightBeacon brings AI-driven analysis to SOCs

Binary Defense has announced the launch of NightBeacon, an AI-powered security operations platform built directly into the company’s security operations center (SOC). NightBeacon serves as the intelligence infrastructure behind Binary Defense’s MDR service, supporting every analyst shift, detection, and investigation across the SOC. Customers benefit from an approximately 30% reduction in mean time to resolution,…

Iran-Linked Hacktivists Claim Wiper Attack on Stryker Systems

A cyberattack has disrupted global operations at medical technology manufacturer Stryker, forcing employees in multiple countries offline and cutting access to core corporate systems.  The incident, which began March 11, triggered widespread outages across the company’s Microsoft environment and left staff temporarily unable to access internal applications and devices.  “When a company the size of…

Agentic attack chains advance as infostealers flood criminal markets

Cybercriminals spent much of 2025 automating their operations, shifting from one-off attacks to systems that can run entire intrusion cycles with minimal human input. Data collected from criminal forums, illicit marketplaces, and underground chat services shows a threat environment where stolen identity data, unpatched vulnerabilities, and ransomware operations are interdependent. The findings come from Flashpoint’s…

News alert: Qevlar AI raises $30M to turn security alerts into actionable defense insights across SOCs

PARIS, March 10, 2026 — Qevlar AI, a leader in AI for transforming security operations centres (SOCs), has raised $30 million in funding for its autonomous AI SOC platform. The funding will support development of technology designed to turn alert investigations into security insights that help SOC teams strengthen their overall security posture. The round…

AWS expands Security Hub for multicloud security operations

Amazon Web Services is expanding AWS Security Hub to function as a centralized security operations platform capable of aggregating risk signals across multicloud environments. With the updated Security Hub, the company said it will introduce a unified operations layer that provides security teams with near real-time risk analytics, automated analysis, and prioritized insights. As enterprise…

Fortinet enhances SecOps with cloud SOC, AI automation, and managed services

Fortinet has announced major innovations across the Fortinet Security Operations (SecOps) Platform. The updates feature next-generation SecOps advancements, including expanded agentic AI capabilities, a preview of FortiSOC, managed services, and endpoint security enhancements delivered through FortiEndpoint. “As attackers weaponize AI to accelerate reconnaissance, exploit development, and social engineering, security operations must function with the same…

Why Business Success Depends on IT Excellence

GUEST OPINION:  IT is the business. When systems fail, operations stop, revenue halts, and customers lose trust. The COO of KLM captured this reality succinctly: “Nobody flies without IT.” In a digital economy, technology underpins every function, from customer experience to core operations. This reality places extraordinary responsibility on IT teams and raises an important question:…

Cyolo PRO 7.0 expands OT-first secure remote access with AI session intelligence

Cyolo has released Cyolo PRO (Privileged Remote Operations) v7.0, a major update that expands OT-first secure remote access and strengthens protection for critical infrastructure and industrial environments without disrupting operations. Secure remote access (SRA) tools focus primarily on managing access. Cyolo has always delivered a more holistic approach, designed to govern all scopes of access…

Chinese group’s ChatGPT use reveals worldwide harassment campaign against critics

A Chinese law enforcement official attempted to use ChatGPT to review its reports on cyber operations, subsequently revealing details of a worldwide online harassment and silencing campaign of China’s critics at home and abroad. In a new threat report released Wednesday, OpenAI said the activity concerned a single account that regularly used ChatGPT to review…

VMware Aria Vulnerabilities Expose RCE Risk

Broadcom has disclosed three vulnerabilities in VMware Aria Operations, including one that could allow unauthenticated remote code execution during product migrations.  One of the flaws, CVE-2026-22719, can allow an attacker “… to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress,” said Broadcom…

VMware Aria Operations flaws could enable remote attacks

Broadcom patched multiple VMware Aria Operations flaws, including high-severity issues that could enable remote code execution. Broadcom has released security updates to address multiple vulnerabilities affecting VMware Aria Operations. VMware Aria Operations is an IT operations management platform that helps organizations monitor and optimize virtual, cloud, and hybrid environments. It provides performance monitoring, capacity planning,…

Security and complexity slow the next phase of enterprise AI agent adoption

Enterprise AI agents are embedded in routine business processes, particularly inside engineering and IT operations. Many organizations report active production deployments, and agent development ranks high on strategic agendas. A new study from Docker, The State of Agentic AI Report, examines how enterprises are deploying agentic systems and the challenges emerging as deployments scale. The…

AI in the SOC: Why Complete Autonomy Is the Wrong Goal

Dan Petrillo, VP of Product at BlueVoyant    As artificial intelligence (AI) becomes more deeply embedded in security operations, a divide has emerged in how its role is defined. Some argue the security operations centre (SOC) should be fully autonomous, with AI replacing human analysts. Others believe that augmentation is the right path, using AI to support and extend existing teams.    Augmentation probably reflects…

Ukrainian sentenced to 5 years in prison for facilitating North Korean remote worker scheme

A Ukrainian national who ran multiple operations to aid the North Korean government’s expansive scheme to  hire remote IT workers at U.S. companies was sentenced to five years in prison, the Justice Department said Thursday. Oleksandr Didenko stole U.S. citizens’ identities and created more than 2,500 fraudulent accounts on freelance IT job forums, money service…

NetBrain R12.3 Brings Agentic AI to Network Operations

NetBrain Technologies has released version 12.3 of its network operations platform, adding agentic AI capabilities designed to autonomously investigate network issues, recommend fixes, and guide engineers through remediation across hybrid and cloud environments. NetBrain Technologies touts manual workload reduction and time savings for engineers The Burlington, Mass.-based vendor positions the release as a step toward…