SOC 2 Logging Requirements: What to Log and How Long to Keep It
SOC 2 logging requirements explained: which Trust Services Criteria cover logs, what events to capture, how long to keep them, and the evidence auditors ask for.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
962 matching stories — announcement, in Security Information and Event Management (SIEM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
ESXi Logs to SIEM: How to Forward Them and What to Detect
How to send VMware ESXi logs to a SIEM with esxcli or vSphere, which log files matter, and the detections that catch ransomware and backdoors on the hypervisor.
MemCurrent: Designing Persistent Memory for Production Agents
AI tools have made it easy to vibe code agents. Building and maintaining an enterprise...
Cribl SIEM Migration: How Cribl and Realm Compare
Planning a Cribl SIEM migration? See how Cribl and Realm handle each stage, from running two SIEMs at once to cutting volume without losing detections. The post Cribl SIEM Migration: How Cribl and Realm Compare appeared first on Realm Security.
How Hamlet uses Databricks Lakebase Postgres to test changes against production data
Hamlet, an AI-powered platform that makes local government decision-making accessible...
IBM security advisory (AV26-1064)
Bullhorn sees red after cyberattack knocks recruitment platform offline
Staffing software giant calls in CrowdStrike as customers face login headaches and questions remain over possible data theft
CrowdStrike Next-Gen SIEM: Cut Ingest Costs and Keep Falcon Data for Years – Axoflow
CrowdStrike Next-Gen SIEM costs climb with retention and third-party ingest. See how Axoflow keeps Falcon data for years in AxoLake and cuts what CrowdStrike bills for.
CrowdStrike Achieves NCSC CIR Enhanced Level Assurance
Best Continuous Compliance Monitoring Software (2026)
Hybrid cloud compliance has outgrown the annual audit. A regulated enterprise in 2026 runs workloads across AWS, Azure, Google Cloud, private data centers and SaaS, and often answers to eight or more frameworks at once. Point-in-time evidence drives cannot keep up with configuration drift that happens hourly. That is why security and compliance leaders are The post Best Continuous Compliance Monitoring Software (2026) appeared first on Seceon Inc.
A Letter to Those Choosing a Trusted Security Vendor
I want to write this post differently from the others in this series - not as analysis, not as a technical argument, but as a direct letter to the people who have made this journey possible.
Ransomware Detection and Prevention
Ransomware remains a serious cybersecurity risk for organizations of every size. A successful attack can interrupt business operations, encrypt critical files, disrupt customer services, expose confidential information, and create significant recovery costs. For organizations that depend on continuous access to business applications and data, even a short disruption can have consequences across multiple departments. Modern The post Ransomware Detection and Prevention appeared first on Seceon Inc
SOAR Security
What Is SOAR Security? SOAR security refers to the use of technology to integrate security tools, automate repetitive operational tasks, and coordinate responses to cybersecurity incidents. A SOAR platform can receive alerts from connected security systems, enrich those alerts with additional information, follow predefined workflows, and initiate appropriate actions based on configured policies. For example, The post SOAR Security appeared first on Seceon Inc.
How HP Is Building an AI-Ready CDP with Databricks CustomerLake
At Data + AI Summit 2026, Luis Alonso, Global Head of Data Strategy & Engineering...
Build better SLOs with RUM and synthetic SLIs
Learn when to use RUM and synthetic monitoring for SLIs, what each source misses, and how to interpret their results together.
Beyond container image signing: How we enforce software supply chain policies at Datadog
Datadog built Turnstile to evaluate signed attestations and enforce software supply chain policies before container images are deployed.
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
Access Isn’t Trust: A Behavioral Risk Framework for People, Service Accounts, and AI Agents
Risk in the agentic enterprise spans people, service accounts, and AI agents. All three act with legitimate credentials, so access controls alone can’t show whether their activity is safe. A behavioral risk framework applies one model to every actor: Verify expected behavior before access goes live, observe activity once it does, analyze behavior for risk … Continued The post Access Isn’t Trust: A Behavioral Risk Framework for People, Service Accounts, and AI Agents appeared fi
Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
Bring Your Own Vulnerable Driver: What Detection Teams Should Actually Hunt
Discover how detection teams can split EDR-killer attacks into four distinct behavior hunts to catch BYOVD and driverless threats before ransomware fires.
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Comparing Coralogix with open source observability backends
We put the same OpenTelemetry data into four backends, Coralogix, ClickHouse, OpenSearch and a Loki, Tempo and Prometheus stack, then set an agent twelve questions against each one, from counting spans to working out what is wrong in a system it has never seen. Then we forced the agents to continue investigating until they got […] The post Comparing Coralogix with open source observability backends appeared first on Coralogix.
How SentinelOne Blocked APT29's CaptiveCrunch Campaign
Learn how SentinelOne's Static AI blocked APT29's CaptiveCrunch campaign on the endpoint, stopping local DNS poisoning and captive portal network lures.
The Good, the Bad and the Ugly in Cybersecurity - Week 42 (2026)
Authorities arrest cyber exec for extortion, cellular implant in Ledger wallets leaks seed phrases, and hackers heat French supermarket fridges to 50°C.
Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind.Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful – exactly what he was known for himself. And as far as recognitions in our industry
AI Decision Models and Their Impact on AI SOC Platforms
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
Making data work across boundaries: The next challenge for policing
Police reform depends on making data work across force boundaries. Connecting data where it lives gives policing national reach, keeps local accountability, and makes AI cheaper and faster to scale.
Elastic Security integration with Google Distributed Cloud: Closing the velocity gap in air-gapped environments
As AI-powered threats grow more complex, traditional security operations struggle to keep pace. Google Distributed Cloud AI SecOps, powered by Elastic, brings AI-driven detection, investigation, and response to fully air-gapped environments.
Realm Security + Scanner: The Data Layer for an AI-Led SOC
Realm shapes and enriches security data upstream; Scanner makes it searchable and detection-ready in your own S3 buckets. The data layer for an AI-led SOC. The post Realm Security + Scanner: The Data Layer for an AI-Led SOC appeared first on Realm Security.
The Agentic SOC: Four Myths, Busted
A security leader finishes a pitch to the board about an agentic SOC that pairs AI agents with analysts to address the coverage gap. A hand goes up. “So, the AI decides who’s a threat?” It’s a fair question. It’s also the wrong one, built on a myth that’s common enough to stall adoption on … Continued The post The Agentic SOC: Four Myths, Busted appeared first on Exabeam.
Why Sweden is re-thinking its cashless society
Why Sweden Is Re-thinking Its Cashless Society. What happens when the screen goes blank? Sweden is forcing every digitally dependent business to face that question. The Riksbank now recommends households keep several ways to pay – including cash. The message for business leaders is clear: convenience is not resilience. Sweden has shown how easy everyday […] The post Why Sweden is re-thinking its cashless society first appeared on BlockAPT | Autonomous AI Cybersecurity.
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Probabilistic Security & Attack Path Management
Adversary path modeling is the capability that most directly embodies probabilistic security thinking - the practice of understanding, before any adversary activity begins, which paths through your environment an adversary would most rationally pursue.
How Much Does a SIEM Cost in 2026? Pricing Models Explained
What a SIEM really costs in 2026: the five pricing models (per GB, per EPS, per device, per user, compute), hidden costs, staffing, and how to compare SIEM quotes.
CrowdStrike Outage: What Happened and How to Limit Future Risk | UpGuard
Learn how you should respond to the CrowdStrike incident and the likely long-term impact it will have on third-party risk management.
How Kubernetes DRA can improve GPU utilization and cut costs
Learn how Kubernetes Dynamic Resource Allocation raises GPU utilization, and what to watch to confirm it’s actually reducing your GPU costs.
Detections Nobody Needed, Data Nobody Watched: How Logbot Uncovers Both
Part 2 of the AI Detection Library Hygiene Series Mike Wade, VP of Customer Success
Should Your AI Agents Be Auto-Approving Their Next Move? | Tuskira
New research shows auto-approve raises attack success on coding agents from 29.2% to 95.6%. What enterprises should require before granting agents autonomy.
IBM security advisory (AV26-1040)
Why Machine-Speed Risk Demands an AI-Assisted SOC
Security analysts traditionally move from an alert to a pivot, a search, a correlation, more pivots, and finally documentation before they can decide what to do. An AI-assisted workflow brings behavioral context, prioritized investigations, search timelines, and automation together, so analysts can review, validate, decide, and respond with far less manual friction. Exabeam Nova AI … Continued The post Why Machine-Speed Risk Demands an AI-Assisted SOC appeared first on Exabeam.