The recent Microsoft announcement on “Volt Typhoon” activity brings the reality of persistent threat actors back into the spotlight.
Read MoreWelcome to the Vectra Blog
Featured blog post
Blog posts


Looking for an alternative to Darktrace? See why 9 in 10 customers choose Vectra AI, the top Darktrace alternative powered by Attack Signal Intelligence.
Read More
As threats become more prominent, it’s important to pose the question: what actually brings clarity? It’s a question that we can struggle with, but we may simply not be approaching it in the right way.
Read More
As cloud compromises become the new normal, Cloud Detection and Response is the answer to monitor and detect suspicious behavior across cloud environments.
Read More
With the number of hybrid-cloud cyberattacks on the rise, SecOps teams now have a way to gain unmatched visibility into all actions taking place across the entire AWS infrastructure.
Read More
Attacker techniques are dictated by the characteristics of the tech stack. So what is the approach needed to defend cloud systems?
Read More.jpeg)
Discover how Vectra AI, through user feedback, has improved its scoring model and user interface to provide more effective threat prioritization and an efficient workflow.
Read More
What do you need to know following the announcement of the integration of Vectra's Attack Signal Intelligence into Amazon Security Lake?
Read More
Vectra CRO Willem Hendrickx why he's excited about the opportunity ahead for AI in cybersecurity.
Read More
Vectra Match ingests intrusion detection signature context for more efficient and effective threat investigations and hunting.
Read More

As a seasoned veteran of RSAC, Aaron Turner has curated a list of themes, must-attend sessions, and personal recommendations to consider as to navigate and prioritize your week in San Francisco.
Read More
72% of security practitioners "think they may have been breached, but don't knowit." Said differently, nearly three-quarters of security teams don't know wherethey are compromised right now.
Read More
When an analyst detects an intrusion, the most critical factor is analyzing the context of the intrusion. We do this by identifying the attacker’s tactics, techniques, and procedures (TTPs).
Read More
Recently, CISA released a new open-source tool named the Untitled Goose Tool that helps organizations investigate threats to Azure AD, M365 and Azure.
Read More
After detecting an event in the detection phase of an incident response and analyzing it in the analysis phase — you can use the automated solution for containment of the four supported AWS services.
Read More
What steps can you take to ensure that your organization is not the weakest link in the chain of critical infrastructure?
Read More

Gain complete clarity on known and unknown threats across your network by combining Vectra Match signature context and the power of Vectra NDR with Security AI-driven Attack Signal Intelligence™.
Read More
This blog outlines the intel in the LastPass communiques and enumerates the attacker indicators while framing the discussion around the "Pyramid of Pain".
Read More
Recently, we investigated suspicious behavior in an environment where Azure passwordless authentication was set up. Prompting the investigations was several users were hit with unexpected Authenticator app prompts. To their credit, none of the users fell for the ruse or let the attacker in.
Read More
On February 9th 2023, a milestone partnership was celebrated between Vectra and KPMG, and they had a lot to share. The discussion centered around the value of EffectiveSecurity Observability (ESO) - powered by Vectra's Attack Signal Intelligence, while KPMG and Vectra hosted a joined webinar.
Read More
Security teams need the right tools to test cloud security controls in ways that emulate real attacker behavior to understand the gaps and ensure they have the proper visibility to stop an attacker.
Read More
When a physical threat presents itself, most people will implement protection mechanisms. When warned of an impending hurricane, people will naturally board up their property and take cover. This behavior is conditioned, but why doesn't that conditioning extend to enterprise security programs?
Read More
With KPMG's guidance and Vectra's technology, organizations can achieve greater visibility into their security posture, reduce risk and reassure the protection of their critical data.
Read More
In this blog, we'll examine known threats aimed at hybrid cloud environments and where you might be able to catch them before they become an issue.
Read More
Through harnessing Vectra's Security AI-driven Attack Signal Intelligence (ASI) for cloud, SecOps teams can continuously monitor and uncover sophisticated threats across their SaaS and cloud environments in real-time.
Read More
2022 brought a surplus of geopolitical drama and the world's first full-on cyberwar. What comes next? Here's an educated estimate.
Read More
In 2023, organisations must prepare for a growing attack surface, the war for cyber skills, and the rise of unknown threats
Read More
Modern cyber threats are increasingly evasive and difficult to detect. Vectra offers a new AI-driven solution: Attack Signal Intelligence.
Read More
When we enter our names, addresses, phone numbers, emails and credit card info - personally identifiable information (PII) - whose job is it to make sure that the information remains safe and not in the wrong hands? The retailer? The consumer?
Read More
Ransomware is a common type of cyber attack that may target individuals and businesses alike. Device users of any kind must be aware of the different types of ransomware attacks and how to prevent them.
Read More
Cyberattacks are still on the rise. Learn more about the problem of preventive cybersecurity and what needs to be changed.
Read More
In terms of delivering Managed Detection and Response (MDR), we view the term "shared responsibility' differently than some. It is more about collaboration than delineation. It is about how Vectra, and our customers work together in a seamless manner to resolve threats.
Read More
On November 1st 2022, after teasing the main show the week before, OpenSSL released their advisory describing two risks to OpenSSL 3.0.0 - 3.0.6. This was originally teased as a Critical level alert, which would have been the first Critical since 2015, however this was downgraded to a High owing to what OpenSSL describe as "mitigating factors".
Read More
Vectra SaaS CTO, Aaron Turner shares how to fix overwhelming security alerts that can cause your SOC team to miss critical threats. See how.
Read More
Cyber threat actors come in a variety of forms. Though they result in unwanted damage, their tactics, goals, and methods of attack differ. Avoiding being a victim begins with understanding the types of cybercriminals, their behaviors, goals, and motivations.
Read More
Last week I attended the Gartner Security and Risk Summit in London. The theme of the summit was Accelerating the Evolution of Security: Reframe and Simplify. From the very first keynote, Gartner laid down the gauntlet. "Change is needed and we must stop doing what we have always done and start learning from our mistakes." It is this very sentiment that set the tone for the show.
Read More
Native integration delivers Vectra's patented Security AI to CrowdStrike XDR, so joint customers can find attacker behaviors across public cloud, SaaS, identity, and networks from a single interface.
Read More
In August 2022, the Vectra Protect team identified an attack path that enables malicious actors with file system access to steal credentials for any Microsoft Teams user who is signed in. Attackers do not require elevated permissions to read these files, which exposes this concern to any attack that provides malicious actors with local or remote system access.
Read More
What value is there in detecting malicious actors if the detection isn't noticed? Vectra makes sure that your security operations see everything, and our updated Splunk Integration is the latest offering to help you do this.
Read More
A major apprenticeship program from the US government could fill vacant cybersecurity jobs - and we're here for it.
Read More
An influential industry analyst now declares NDR has reached the Hype Cycle's "Slope of Enlightenment." Vectra had confidence all along
Read More
A comprehensive backup strategy is a cornerstone of any DR plan. But how would you distinguish between legitimate backup activity and malicious data exfiltration?
Read More
We at Vectra think that SOC teams need to focus on 3 challenges to stay ahead of cyberattacks. Coverage, Clarity�Control
Read More
A US government agency provides a powerful framework for understanding today's cybersecurity challenges. Here's where Vectra AI fits in.
Read More
If you ask security analysts to describe the biggest pain points in their role, you will no doubt get a diverse set of answers. One thing that they will almost certainly have in common is the challenge of dealing with alert fatigue.
Read More
Cybersecurity authorities from the United States, New Zealand, and the United Kingdom have released a joint Cybersecurity Information Sheet (CIS) that recommends proper configuration and monitoring of PowerShell to address the recurrence of the scripting language's use in cyberattacks.
Read More
Many security propositions claim artificial intelligence provides a value boost. The real story is more complicated.
Read More
How to move cybersecurity forward? At the core of this discussion, we always find the same core values. We at Vectra live up to the 9 C's.
Read More
Hybrid working models are a hacker's dream! Every remote IP is a potential risk. Learn how to protect your organization in the modern world.
Read More
Most marketing messages are a cocktail of sober reality and hyperbole. Of course, the proportions may vary from season to season, from one company to the next, but hype continues to be a perpetual factor in the cybersecurity world. At Vectra, however, we are firm believers in sober reality.
Read More
The MITRE ATT&ACK framework helps to keep your business secure. Learn how Vectra leverages MITRE ATT&CK and supports MITRE D3FEND.
Read More
Our Vectra Masked CISO series tackles some of the biggest issues in security and how to overcome them.
Read More

In order to help security teams validate the effectiveness of their Azure AD security controls and stop future attacks, the Vectra platform continuously monitors user activity and reveals instances of users bypassing multi-factor authentication (MFA) and other preventative controls.
Read More
Regardless of discipline, cybersecurity professionals deal with mounting pressure each day to make the right decisions and strategically play the right hand to keep their organisations a step or two ahead of cybercriminals. It can be stressful.
Read More
The Vectra Masked CISO series gives security leaders a forum for discussing the biggest issues in security and advising their peers on how to overcome them.
Read More
We have never seen a full-on cyber conflict rage across the world's digital systems, but if the situation in Ukraine leads to such a thing, CIOs and CISOs will find themselves on the front lines. With escalation patterns uncertain and no "rules of the road" governing cyberwar, any organization risks becoming a casualty. Already, CIOs and CISOs are seeing their roles evolve and enlarge. Vectra AI CRO Willem Hendrickx discusses their transformational hour
Read More
What If there was a Supply Chain Compromise of an IDP? The recent security incident at Okta represents yet another perspective on supply chain compromises. This blog provides perspective on the current situation and mitigation and defense strategies to manage such an event.
Read More
The cloud is complex. AWS alone has over 200 services (and quickly growing). Securely configuring even a small set of these services to operate at the scale of modern organizations today creates a variety of challenges.
Read More
It's only human to focus on external threats to your well-being. This often applies to organizations and their approaches to security as well; which is why so much energy is typically put into perimeter security. Yet, this approach is antithetical to the zero-trust methodology: Organizations must also pay attention to internal-to-internal and internal-to-external traffic just as much as traffic coming in.
Read More
I want Vectra to be known also for its values, for its vision, for its people and attitude, and for its passion for making the world a safer and fairer place. In short, for our culture.
Read More
"Artificial intelligence is no match for human stupidity," observed a wry Albert Einstein. Today, we have evolved to where AI can deliver critical and indispensable advantages in the race toward cybersecurity. Nevertheless, even brilliant security managers do not always see how or why this is the case.
Read More
Updated perspective on cyberthreats as a result of ongoing Ukrainian/Russian conflict, including specific custom recall queries, and aggregation of common Russian state actor TTPs.
Read More
As the new reality ofthe continual dangers of cyberwar gradually sets in, organizations globally are working to harden their defenses. Most cyber-attacks are blocked by preventative safeguards. Highly motivated attackers, however, tend to find ways to get through those defenses.
Read More
Advanced Microsoft Cloud Attacks often attack through three key areas which we enumerate in this blog: Service Principals, Multi-Factor Authentication (MFA) Downgrade, and Mobile-Device MFA Authenticators.
Read More
While this wiper malware is new, it reuses much of the playbook employed by Russian state actors and ransomware gangs - fighting back requires us to sharpen the tools we already have.
Read More
Vectra customers should be aware that current global events related to Russian recognition of separatist regions of the Ukraine carry with them the risk of increased cyber activity conducted by Russian state level actors. This includes evidence that the FSB, the main Intelligence Organization in Russia, is responsible for the DDoS against Ukrainian systems in February 2022.
Read More
The role of the CISO has never been clearly defined, and every CISO works differently.They are under a lot of pressure, and this leads to regular rotation of roles. The Masked CISO explains how this could be stopped if CISOs were given more autonomy and responsibility.
Read More
New Vectra CRO wants to achieve aggressive growth and continued global expansion for Vectra's leading network detection and response platform.
Read More
In this blog series, Kevin Kennedy, SVP of Products at Vectra goes beyond the buzzwords and explains what artificial intelligence and machine learning truly mean in relation to cybersecurity. He explains how organizations using AI can gain an advantage over today's attackers that will stop them in their tracks.
Read More
In this blog series, Kevin Kennedy, SVP of Products at Vectra goes beyond the buzzwords and explains what artificial intelligence and machine learning truly mean in relation to cybersecurity. He explains how organizations using AI can gain an advantage over today's attackers that will stop them in their tracks.
Read More
Software attacks with an extortionist background are unfortunately becoming the norm for many companies. But what if automated anti ransomware tools could unmask malware at an early stage and combat them effectively - even before they can cause harm?<br>
Read More
As we saw with the Log4J vulnerability, cybercriminals only need a single opening to infiltrate your environment. And while another vulnerability can't be prevented, there's still a lot that can be done to make sure you're ready for the next one.
Read More
With ransomware attacks continuing to dominate media headlines, it's clear that a security approach centered on prevention no longer suffices. A shift towards an "assume compromise' security approach prepares your business to deal with the intensity and frequency of today's ransomware attacks. To that end, advanced detection and response capabilities play a crucial role. In this blog, you will also learn why a large British multinational insurance company chose Vectra, Wipro's Venture Partner, to meet its security needs.
Read More
A threat-led approach is key to an organisation's security strategy. CISOs should measure security based on their ability to discover if they've been breached, mean time to breach when testing security, or the mean time to detect unknown threats.
Read More
Every year the world of cybersecurity encounters new challenges and obstacles for organisations to overcome, but 2021 managed to be an exceptionally dangerous year. So how will the lessons learnt from 2021 shape the cybersecurity landscape? Here are four areas of cybersecurity that will evolve in 2022.
Read More
When it comes to cyber security, the old adage of "doing the simple things well' is more relevant today than ever before. Three simple principles have been around for decades but they hold true now more than ever because we live in an increasingly cloud-orientated environment where we need to be vigilant at all times.
Read More
Threat actors can use the Log4J vulnerability as a platform for launching attacks, but what does this mean for cloud environments? Find out exactly how attackers are exploiting this vulnerability and what this could mean for your organization.
Read More
Agile has its uses. It's increasingly being adopted as a technology wide operating model-to drive transformation everywhere, from helpdesks to datacenters. But is it always appropriate?
Read More
A few days after the Log4Shell vulnerability was discovered, we now have more observations about how the exploit is being leveraged. Here's what we know, today.
Read More
A new 0day was discovered in the log4j application on December 10, 2021. This vulnerability impacts a widely used logging solution spanning an incredibly large attack surface.
Read More
Asking the right questions to your vendor is critical to dissociate the trendy marketing wording from reality. Asking questions such as "What type of machine learning algorithms does your product use?" will help. Discover the top nine questions we think you should ask.
Read More
Exclusive cybersecurity research presented in a new report, details how hundreds of security leaders are addressing today's complex cyberthreats in their organisations.
Read More
CISOs Must be Brave Enough to Throw Away Their Security Playbook or Suffer the Consequences!
Read More
Vectra has been recognized as a DeloitteTechnology Fast 500™ award winner - a ranking of the fastest-growing technology, media, telecommunications, life sciences, fintech, and energy tech companies in North America.
Read More
Introducing Sidekick MDR for VECTRA customers with 24*7 eyes-on-glass service leveraging cloud-scale analytics of the VECTRA Cognito platform to enable security teams to meaningfully detect and respond to ransomware, nation-state and insider attacks.
Read More
Hear what Tallink, the largest shipping company operating in the Baltic Sea, says are the most valuable capabilities in an NDR solution and what you need to know when selecting one for your environment.
Read More
"Do your part" is the theme of this year's Cybersecurity Awareness Month. See what you can do right now so cyberattacks don't become a problem in your Microsoft cloud environment.
Read More
AI can save your SOC valuable time by automating workloads, while accurately tracking down cyberattacker activities found in ransomware and supply chain attacks.
Read More
Ransomware. It is the new digital bogeyman. In the UAE, an industry survey from June 2021showed the extent to which the country (and by implication, the wider region)has been subjected to ransomware. Some 37% of respondents said they had beenvictims in the previous two years. A staggering 84% elected to pay the ransom, only for most of them - 90% of those who paid - to suffer from second attacksthat often came from the same bad actors.
Read More
Vectra Detect cybersecurity solution is purpose-built to detect and stop ransomware attacks. The agentless and AI-driven Cognito Platform sees and stops ransomware before it can encrypt files and exfiltrate data by automatically detecting attacker behavior.
Read More
Stopping ransomware requires a new way of thinking. See why you can't only rely on legacy tools to keep your organization safe, but rather how you can leverage AI to detect when this invasive threat enters your cloud.
Read More





The recent Microsoft announcement on “Volt Typhoon” activity brings the reality of persistent threat actors back into the spotlight.
Read More
Looking for an alternative to Darktrace? See why 9 in 10 customers choose Vectra AI, the top Darktrace alternative powered by Attack Signal Intelligence.
Read More
Attacker techniques are dictated by the characteristics of the tech stack. So what is the approach needed to defend cloud systems?
Read More