All news with #security analytics tag

🛡️ Cloudflare outlines a new approach to ensure Verified Bots remain trustworthy over time by pairing identity verification with ongoing behavior monitoring. The company will measure how bots respect site preferences (robots.txt), respond to rate-limiting (HTTP 429), and other signals to produce an explainable trust band rather than a permanent judgment. This system complements Bot Preference Sync and Bot Management, enabling site owners to publish preferences and decide how automated traffic is handled while giving bot operators a way to demonstrate sustained compliance.

🛡️ September 2026 saw a sharp rise in global cyber activity: weekly attacks averaged 2,803 per organization, up 48% year over year, with education the most targeted sector. Phishing rates increased to 1 in 91 emails and ransomware incidents rose 53% year over year. GenAI prompt usage expanded, with 1 in 39 prompts posing a high risk of sensitive data leakage, highlighting growing exposure across industries and regions.

🛡️ This post shows how to capture AWS Bedrock Guardrails intervention events from model invocation logs, transform them into OCSF Detection Finding records, and ingest them into the CloudWatch unified data store for centralized analysis. It explains why guardrail interventions are security-relevant, the limitations of ingestion-time processors, and the need for a dedicated transform step to split and normalize assessments. The end-to-end pipeline uses an AWS Lambda to map fields, assigns severity based on policy type, and writes results to a log group associated with AWS S3 Tables so analysts can query with Athena or CloudWatch Logs Insights.

🔍 The IANS and Artico Search 2026 Security Budget report shows average security budgets rose 5% but the median remained flat, leaving 55% of CISOs with no increase or cuts. Funding outcomes vary by company performance and ownership, with VC-backed and high-revenue firms more likely to boost security spending. AI is the top new priority, often funded outside formal security budgets, and organizations tracking AI spend more frequently report increases. The report advises CISOs to create a distinct AI budget line to clarify costs and priorities.

📊 Amazon Simple Email Service (SES) now provides tenant-level deliverability insights in Virtual Deliverability Manager (VDM). The VDM dashboard adds a Tenants view with per-tenant metrics and a detail page that breaks metrics down by mailbox provider, identities, and configuration sets. Customers can search and export tenant sent messages and query metrics via the BatchGetMetricData API using the new TENANT_NAME dimension. VDM is available in all Regions where Amazon SES is offered.

🔍 AWS CloudTrail now integrates with Amazon Q Console to let you investigate account activity using natural language queries. You can ask about CloudTrail configuration, search logged events for security investigations, and troubleshoot operational issues without writing queries. The integration queries CloudTrail trails, CloudWatch log groups, and event data stores to provide answers grounded in your account activity. It is available in all AWS commercial regions where Amazon Q Console is supported.

🔒 AI is reshaping enterprise security by automating monitoring, analysis, and routine tasks to help teams focus on the most critical threats. Experts highlight uses such as enhanced network and user monitoring, deeper visibility into security posture, SOC streamlining, and connecting benign events into meaningful attack signals. Organizations should integrate AI into existing programs, validate models continuously, and phase automation in cautiously while retaining human oversight.

🔍 Security operations research shows that AI-driven SOC workflows depend more on the fidelity of underlying telemetry than on specific LLM choices. The Provably Better Data project evaluated multiple LLMs across controlled CTF and incident response benchmarks using Corelight, firewall, Snort, and NetFlow telemetry normalized to OCSF. Results found that high-fidelity protocol-aware logs produced 2–4x better outcomes in accuracy, evidence coverage, and investigation time, and reduced analyst rework and hallucinations. The study advises SOC leaders to prioritize data quality and structured telemetry when investing in AI automation.

🔍 Enterprise SOCs are investing in AI but struggle to convert tools into measurable operational gains. Many initiatives add complexity and fragmented workflows instead of reducing analyst workload. Successful deployments prioritize explainability, augment existing playbooks, and unify access to disparate security tools. Clear governance and incremental automation help turn AI pilots into repeatable operational improvements.

🔍 Amazon CloudWatch Logs Insights now supports 25 new commands and functions to enhance log querying, transformation, correlation, and analysis. The additions include type conversion and encoding, date/time, string, JSON inspection, statistical, sessionization, sequencing, null-handling, comparison, join, and lookup enrichment capabilities. These features are available today in all commercial AWS Regions and extend common tasks such as outlier detection, time-window comparisons, enrichment with lookup data, and handling of nulls in time-series analysis. See the CloudWatch Logs documentation for details.

🧠 The article argues that effective AI-enabled SOCs should mirror Kahneman’s dual-system model: a fast, autonomous layer handling ~98% of alerts and a slow, deliberative layer for the small fraction needing human judgment. It warns against asking analysts or large language models to perform repetitive triage and emphasizes in-house investigation to retain the knowledge base. The right architecture frees analysts to supervise and improves detection over time.

🔍 Security teams often default to retraining AI models when detections fail, but the real root cause is usually upstream data issues. Fragmented telemetry, inconsistent schemas and stale baselines degrade ML effectiveness long before models see events. Standardizing schemas, monitoring data quality at ingestion and applying governance to security telemetry are practical priorities that restore detection reliability without wholesale platform replacements.

🔍 The author recounts multiple cases where threat intelligence feeds and advisories mischaracterized malware or buried stronger indicators in machine-readable files. They describe a commercial feed mislabeling a Windows DonutLoader variant as the Linux Chalubo RAT, an official advisory whose PDF lacked stronger hashes present in the STIX bundle, and a CERT report with binary-level discrepancies. The piece stresses that labels and pipeline metadata are guesses until validated and urges analysts to open structured files and detonate samples when stakes are high.

🔔 Google Cloud announces preview support for long-lookback alert policies in Cloud Monitoring using PromQL, enabling queries across up to two years of metric history. The feature unlocks dynamic thresholding—alerts that compare recent behavior to historical baselines—helping catch anomalies that static thresholds miss. Google outlines example algorithms (moving averages, z-score, and seasonal time-offsets), discusses trade-offs like flakiness for new workloads, and shows a practical use case for preventing runaway spend.

🔍 New research from KnowBe4 finds cybersecurity leaders increasingly lack confidence in detecting threats on non-email channels like Slack and Microsoft Teams. An Infosecurity Europe 2026 survey of 169 professionals reports that 50% of organizations do not have strong visibility across messaging and social platforms, even as 60% say attacks are moving beyond email. While email remains viewed as the riskiest channel, confidence in stopping email attacks (83%) is far higher than for Teams (61%), social media (51%), SMS/WhatsApp (50%) and Slack (40%).

🔒 Microsoft commissioned Forrester Consulting to evaluate the economic impact of consolidating security with its AI-first, end-to-end platform. Based on interviews and a survey of customers, Forrester modeled a composite 10,000-employee B2B organization and projected $30M in benefits against $13.4M in costs over three years, yielding a 124% ROI and $16.6M NPV. The study highlights faster decisions, reduced friction, and improved defender productivity as key operational gains.

🔍 Storage Insights datasets now include activity insights that provide near-real-time visibility into object and bucket operations across your Google Cloud Storage estate. These BigQuery-linked views expose object-level writes, updates, deletes and errors, bucket-level aggregates and regional traffic patterns to support cost optimization and faster troubleshooting. The feature is generally available and customizable by org, folder, project, or specific buckets, enabling queries, Looker visualizations, and integration with other Storage Intelligence capabilities.

🔎 The SOC-CMM 2026 report shows rapid AI adoption across SOCs but limited perceived value: only about 10% report excellent value while 71% report some or no value. The dominant deployment pattern is the taker model—off‑the‑shelf AI bolted into existing tools—creating fragmented workflows and weak handoffs. The report argues the next wave must be architectural: AI that operates across detection, hunting, investigation, remediation, and threat intel with built‑in governance and institutional knowledge.

🛡️ This post explains how AWS Shield Advanced attack flow logs capture metadata during DDoS events and publish records to Amazon S3, CloudWatch Logs, or Data Firehose. It outlines the fields included in each flow log entry, describes delivery configuration and required IAM permissions, and shows how to create the CloudWatch Logs delivery objects that connect a Shield protection to a destination. The article also covers output formats, file size and timing, cost considerations, and cross-account/Region aggregation options.

🔍 A new paper from Silobreaker and the SANS Institute warns that business leaders often misunderstand threat intelligence and its value, creating an "intelligence–stakeholder gap." The report, launched at Infosecurity Europe 2026, finds that intelligence outputs can be overlooked or misinterpreted, limiting funding and visibility for intelligence teams. To close the gap, teams must tailor briefings to senior leaders, provide forward-looking exposure analysis, prioritise speed and seek regular stakeholder feedback to ensure intelligence changes decisions and drives risk-informed actions.