Nathan Swift @SwiftSolves

InfoSec experts need to be stepping up and speaking out more. AI is a huge challenge on multiple fronts and we’re the experts that need to be leading the way.

Zack Korman @ZackKorman

2 days ago

I really need more big names in cybersecurity to come forward and state the obvious: cybersecurity is real and works and yes we absolutely can contain an AI even if it’s extremely good at finding zero days.

117 183 1K 217K 125

OpenAI’s research agents leaked 53 user pics as unlisted links, then said they “can’t reassociate” them with you. Cute. We associate them with a lawsuit. When the sandbox fails, we don’t. 1-800-53-LEAKS zerohedge.com/ai/openai-admi…

I'm actually really excited for the new ISOC, basically bringing more Sentinel capabilities natively into Defender XDR If you'd like a less salesy breakdown of the changes and some guidance, @ITguySoCal wrote a nice blog post here: patriotconsulting.com/blogs/2026/09/…

Microsoft Security @msftsecurity

5 days ago

XDR and SIEM now in one platform. Meet the new ISOC in Microsoft Defender—a SOC built for agentic security. Here to help you investigate and respond more efficiently. msft.it/6019ag5T1

10 85 490 665K 346

Open-weight models are essential to a healthy AI ecosystem. Together with others across our industry, we are outlining a path for open-weight models to strengthen American competitiveness and expand economic opportunity, while protecting national security. microsoft.com/en-us/corporat…

keyboard_arrow_left Previous keyboard_arrow_right Next

Dario has written that we need to “pace the frontier,” and Sam has agreed. People may be surprised by my response: go ahead. You guys are the frontier. By any reasonable metric — market share, revenue growth, model capability — the two of you have a duopoly on frontier intelligence. You’ve also claimed the lead is widening because of recursive self-improvement. I don’t see what you see in the lab. If the unreleased models are scary enough that you think you should slow down, I support your decision to be responsible. But stop pretending you need anyone else’s permission. Stop pretending antitrust law has to be suspended so you can form a cartel. Stop pretending you need a regulatory approval process that supersedes product liability. Stop pretending METR is independent when it is intertwined with Anthropic’s investors and staff. Stop pretending you need those same evaluators to police competitors who aren’t even at the frontier. Most of all, stop pretending the motivation to slow down is purely altruistic. You face massive product-liability exposure if your products enable a truly damaging cyberattack. The market already punishes models that behave in unpredictable or unauthorized ways. After the Hugging Face episode, it is simply good business for OpenAI and Anthropic to trade some raw power for reliability and predictability. Call it alignment if you want. It is also just giving customers what they want. Pacing the frontier would also create breathing room for a more intelligent conversation about regulation than Bernie Sanders’ “shut it all down.” China is very unlikely to join a global agreement, as you know, and that has to be taken into account as well. So go ahead and pace the frontier. You are the ones setting it. The easiest way not to build superintelligence is for you to agree not to build it. Demanding your preferred regulatory framework as the price of that will look like blackmail of the public and the political system. So just do it. If you do, you’ll buy goodwill for the next conversation. If you don’t, we’ll know this was just another bid for regulatory capture — or an election-season psyop.

I rarely share about my company, but it's such an amazing place to work If you live and love Purview and AI Governance (and don't mind working with me...), we might have a role for you ;) patriotconsulting.com/career/purview… 32 hour weeks, great benefits, but most of all, amazing people :)

Happy to share one of my first blog posts at @nvidia . This collaboration with @CrowdStrike shows the potential for open models to support specialized defensive capabilities at machine speed and scale. Evaluating defensive AI requires both realistic attack variation and evidence of what actually occurred. Controlled offense provides both by exploring different attack paths while preserving each action trace and the corresponding telemetry. This evidence lets us measure what the defensive system reconstructed and detected, identify gaps, and retest validated detections against independently seeded attacks. Nemotron 3 Ultra orchestrated the defensive workflow, while a fine-tuned Nemotron 3 Super handled detection writing and repair. Telemetry grounding, replay, and independent review added the validation needed to improve performance while keeping generated detections testable and reviewable. Looking forward to what comes next as we continue building on these results with partners across the open ecosystem. developer.nvidia.com/blog/building-…

I made a little tool which you can use (with or without an LLM) to make (I think very cool) network diagrams, business process diagrams, and it features a journey mode to walk people through things! mr-r3b00t.github.io/net_draw/

Hopefully you listened when I said get your resumes ready. @GreyNoiseIO is hiring Threat Researchers who will develop and exploit first, second, and third-party access and sources to produce cyber threat intelligence that practitioners will use to detect, disrupt, and impose cost on adversaries. job-boards.greenhouse.io/greynoiseintel…

It's dog days of summer 2026, I am using Claude to finish up some more refinements of my game Rank and File, (Need a better name tbh) , and GH CoPiliot working on my AI App knowledge by coding up examples , studying them and asking questions, a weird weekend.

Hey folks! Def need to register for this if interested in AI, defense, what we've been working on the past year and a half and how we applied AI to create some amazing synergies for the SOC and respond faster than ever thought possible before. I'll be driving, showing the tech, but how it has a huge impact in the future of cybersecurity! Register now!! #BinaryDefense

Binary Defense @Binary_Defense

3 months ago

Tomorrow, we're opening the doors. If you've been following the conversation around AI in the SOC and wondering what's real versus what's just another demo, I'd encourage you to spend an hour with us. We'll show you the exact workbench our analysts use to run our own 24/7 SOC.

2 1 14 15K 7

In this episode of the Microsoft Threat Intelligence Podcast, Sherrod DeGrippo joins Aurora Johnson of SpyCloud & Amitai Cohen of Wiz to discuss their Sleuthcon talks on two rapidly evolving threats: software supply chain threats and smishing ecosystems. msft.it/6019vYfqx Smishing ecosystems operate as complex service-based economies, like a cybercrime sub-culture with specialized roles dedicated for phishing panels, infrastructure, and monetization. These attacks leverage bulk messaging platforms and advanced cash-out techniques like NFC relay to scale fraud globally. Meanwhile, software supply chain attacks exploit poor configurations, over-reliance on auto-updates, and vulnerabilities in CI/CD workflows to compromise widely used packages. Defenders are grappling with “spaghetti dependencies” that allow malicious packages to spread rapidly. Both topics emphasize how cybercrime operates as like a mature business that is highly collaborative, scalable, and accelerated by AI. Defenders must focus on fundamentals like security configurations and adding guardrails like dependency pinning and controlled updates.

We are thrilled to announce our 2026 Cyber Security Scholarship recipients! Meet these four amazing students here: ruraltechfund.org/meet-our-2026-…

In search for Solomon Kane.

Someone hid a self-replicating worm inside 37 npm packages. Written in Rust. Hidden behind an eBPF kernel rootkit. Talking to its operator over Tor. It steals 86 environment variables. AWS keys. GCP keys. Vault secrets. Kubernetes tokens. Your Anthropic API key. Your OpenAI key. Your Exodus wallet seed phrase. Then it uses your own npm credentials to republish itself into your packages. So your code infects the next developer. Who infects the next one. The commits were backdated up to 13 years. The commit author name was “claude.” The malware named itself after the AI to hide in plain sight. The attacker also left their own wallet recovery phrase in the debug data. Nobody is having a good day. Check your preinstall hooks.

Aikido @AikidoSecurity

4 months ago

⚠️ New "IronWorm" supply-chain attack: 30+ npm packages from @ asteroiddao shipped a malicious Rust binary firing on preinstall. It sweeps 86 env vars + 20 credential files (AWS, GCP, Vault, npm, plus AI keys like Anthropic & OpenAI), hits Exodus wallets, hides behind an eBPF

46 181 794 616K 428

Howdy folks! Taking a break from my twitter break to let yall know that we released a new @GreyNoiseIO product yesterday. It's called Project Swarm. We've been quietly not-so-quietly working on it for a few years. You can buy it now. It costs $1. There are lots of vulnerabilities on edge-facing apps. To catch in-the-wild exploitation of them, we @ GreyNoise run sensors on the internet. New AI models means more vulnerabilities being identified and exploited, and FASTER. Long term, software and hardware will probably get better, but in the meantime we're gonna have to deal with A LOT of vulnerabilities. At GreyNoise, the sensors we run are basically honeypots- we bait attackers to scan and exploit them which enables us to learn where the attackers are, which vulnerabilities they are exploiting, what it drops, and what it looks like on the wire. From ~2020-now it took us years to build up our fleet. Now anyone can use our new product to deploy their own sensors on their own networks, or an entire fleet of any size, in a day. You can rip back the data and do whatever you want with it. You can resell it, put it into your product, or just stare at it- whatever you want! On our side, we aggregate the data and pour it into a community dataset that everyone shares. As more people join, the data gets bigger and better. Couple neat features: - Sensor deployment is a single bash command on any modern linux distro that supports iptables and wireguard. - Sensors and vulnerable software (profiles) are abstracted into different logical concepts, which means the "what" and "where" are different things, and the sensor is not constrained by the compute required to run the vulnerable software. Also, no matter how hacked the profile (honeypot) gets, it can't touch your host sensor or the rest of your network. - Sensors can run fake honeypots, real software, or even real hardware (bridged with a raspberry pi) like old crappy routers and modems (or expensive firewalls and VPN gateways 👀) - You can create dynamic blocklists that block IPs sourced from your own sensors in real time, so if a remote IP address *looks at your network* the wrong way, you block them instantly. - All the PCAP data is available to you in a gorgeous and intuitive interface at near real time and fully enriched against all of our (thousands of) rules. We're working on the host metadata (malware, syscalls, host behaviors) as well, but this will come later. - If we don't tag a CVE that's interesting to you, you can write a Suricata rule to tag it yourself once and your data gets tagged with it in real time forever. - You can instantly download PCAPs of any exploits that hit your sensors. - If you don't want your data shared with the community dataset, you can talk to our team and we'll work out rights to make it private. Check it out! There's a lot of moving pieces to make this work and we expect bugs, but it's available right now. Join the fight! greynoise.io/project-swarm

keyboard_arrow_left Previous keyboard_arrow_right Next

I've added 6 more internal APIs and enhanced existing ones, especially Defender and Purview Thanks to @SkipToEndpoint, I mapped out M365 Apps (config​.office​.com) and Intune Autopatch Over 400K lines of code over 3 days, imma 10x garry tan 🤣 LMK if you want anything added

Nathan McNulty @NathanMcNulty

6 months ago

So excited to share my fork of the nodoc project! :) Last year, @x_delfino showed me the nodoc solution they built, initially for the Ibiza IAM API into OpenAPI specs to better understand API surface, security, risks, etc. More to come, but v1 is here: nodoc.nathanmcnulty.com

7 23 107 19K 74

#ClaudeForBlueTeam - Day 18! Keeping with the Sysmon config theme - you can prompt Claude to build you a heatmap of your Sysmon config. Looking at raw XML isn't ideal. This way, you can easily visualize what your Sysmon config covers and does not cover.

I'm a huge fan of using role assignable groups and restricted management admin units - this article is great at explaining why we should :) One thing is missing though: Tier 0 assets in Arc should always be locked down to prevent this type of attack learn.microsoft.com/en-us/azure/az…

Compass Security @compasssecurity

6 months ago

Unprotected groups in Entra ID can lead to privilege escalation. Part 2 of our 4-part series shows how weakly protected groups can be abused to bypass controls, gain privileged access, and lead to full compromise—and how to detect this with EntraFalcon: blog.compass-security.com/2026/03/common…

0 35 157 42K 162

If you use #KQL to hunt for attacks, this post is for you. I want to tell you about a powerful new operator you can use to hunt: the lift operator.