Welcome to the Vectra Blog

Vectra AI has been recognized by GigaOM and peer recognized in Gartner Peer Insights Report (separately through their own decision processes) for Vectra ND

Discover how Vectra AI and CrowdStrike collaborate at Fal.Con 2024 to address modern security challenges with next-gen SIEM and AI-driven network telemetry.

See how Vectra AI delivers optimal load times for customers across our UI

SOC professionals spend nearly 2 hours daily investigating false positives. Learn how Vectra AI can help optimize and automate their workflow.

Identity is the center of the modern enterprise and it takes just one compromised identity for attackers to quickly navigate complex network systems and steal critical data.

Vectra AI and Google Chronicle SIEM work together to help security teams streamline threat investigations.

Get an inside look at how Vectra MXDR analysts help customers respond to emerging security threats.

Copilot for Microsoft 365 promises enterprises new opportunities backed by AI efficiency, but are attackers also benefiting from this new functionality?

Hear from Zoey Chu, Vectra AI Product Marketing Manager, and Gearoid O Fearghail, Vectra AI Product Manager, as they explain the power of Host ID and how it helps you track down attackers with ease.

This blog outlines three vulnerabilities surfaced from how Google Cloud handles user-asociated HMAC keys.

Phishing attacks are still on the rise, in fact, they never went away. See why phishing remains a huge threat to users and SOC teams everywhere.

Today’s hybrid environments mean cyberattacks are also hybrid. Here are five real-world examples where hybrid attackers are exposing environments beyond the endpoint.

Make sure to ask your cybersecurity vendors the right questions to validate their claims about AI and help hold them accountable for the efficacy of their attack signal.

Ed Amoroso, founder and CEO of TAG Infosphere Interviews Mark Wojtasiak, VP of Product at Vectra AI where they discuss how the right approach to AI can stop today’s hybrid attacks.

With the dust of XZ Utils backdoor in our rearview, what can enterprise SOCs learn for future security risk management? According to one CTO, it’s a lot.

Today’s hybrid attackers expose security gaps, compromise identities and use a variety of tactics to hide and progress inside enterprise environments.

Learn more about the XZ Utils backdoor vulnerability and how to find out if your organization has been exposed.

Top security teams key in on these five areas to effectively prioritize urgent threats.

Unrivaled signal clarity and rapid response can help you protect your complex IT environment.

Learn about the attacker group Scattered Spider, how they operate, and how Vectra AI helps you defend against their hybrid attack techniques.

The way security technologies work today is not working out for SOC analysts.

Even if you’re doing everything right, you’re still vulnerable.

Technology integrations are the heart of the modern SOC.

Discover the latest Vectra AI Platform functionality.

Move from SIEM to Signal with Vectra AI 

Recent enhancements to the Vectra AI Platform include added detection coverage, the industry's first global open MXDR service and key investigation and response controls.

Explore Vectra AI's advanced solutions to combat state-sponsored threats with best practices from CISA, NSA, FBI, and NCSC-UK. Enhance your security with detailed logging, behavioral baselines, and AI-driven prioritization for effective LOTL defense.

Vectra NDR enabled by Gigamon for unified observability into evolving hybrid cloud threats, from the network to the cloud.

Today’s cybersecurity challenges are rooted in the evolving hybrid environment of organizations and struggle to recruit and retain talent. Learn how Vectra MXDR answers these challenges.

Technology integrations are the answer to achieving an open XDR solution. Read how Vectra AI Platform Integrations can help you accomplish an XDR strategy with your current security technology stack.

Why uncovering command and control channels is key to stopping today’s cyber attacks.

Is your firm considering M&A activity this year? 

Explore a real-world Amazon account takeover scenario underscoring the vulnerabilities in SMS-based MFA and advocating for more robust security measures.

Explore the pervasive impact of Shodan on network security, from its origin to its contemporary applications in cybersecurity.

Demystifying hybrid attacks begins with seeing that all attack vectors comprise a single, hybrid attack surface, all attacks are hybrid attacks and end with signal clarity.

With the global migration to the cloud, enterprises had to rethink how they track malicious activity in their environments.

The new Vectra AI Platform Syslog Connector collects all threat events and sends them directly to any syslog server.

Innovative XDR capabilities can deliver the ML/AI capabilities your security team needs to outpace expanding AI-enhanced threats.

The escalating influence of generative AI on business and cybersecurity in 2024: its growing adoption, potential challenges, and the critical need for regulatory oversight.

Buyers should be aware that there are really four primary spaces that XDR vendors are coming from.

What does extended detection and response (XDR) security mean?

The security landscape is plagued by tools that cause more inefficiencies, more ineffectiveness, and more breaches than ever.

Vectra CDR for AWS enables SOC teams to keep pace with the ever-growing speed and scale of sophisticated hybrid attack.

On May 23rd, 2023, Barracuda announced a vulnerability (CVE-2023-2868) in their Email Security Gateway appliance that was being exploited in the wild as far back as October of 2022.

Vectra AI’s Security Research Team identified issues in Entra ID and Microsoft 365 logs that make your job harder — and may help attackers evade detection.

In my last post, we talked about the importance of security testing as one of the best ways to improve defenders’ skills and expertise and build confidence that ongoing security investments continue to provide ROI.

If you are in security operations, have you ever wondered how long it will take before use cases and playbooks are ready or prove value to your organization?

The best ways to improve defenders’ skills and expertise and build confidence that ongoing security investments continue to provide ROI.

Insight and key takeaways from Gartner Security and Risk Summit 2023

Explore the challenges confronting Security Operations Center (SOC) teams, addressing the surge in alert volumes and advocating for a redefined perspective on threat detection effectiveness.

Just a week before the conference MGM Resorts and Caesar’s Palace suffered major security breaches. Read how Vectra AI’s integration with CrowdStrike can potentially provide a powerful solution to security breaches like those.

In this blog, we explore the true purpose of Cybersecurity Awareness Month and why it is important for end users to understand their role in protecting organizations. We delve into the "Defenders' Dilemma" and shed light on the challenges faced by cybersecurity professionals. Discover how attackers prey on human nature and the impact of their actions on defenders' workload and well-being. Join us in advocating for empathy and teamwork in the fight against cyber threats.

Hooray! It’s Cybersecurity Awareness Month – a security marketer's dream. An entire month dedicated to building awareness and educating the public on adopting safe cyber practices.

Discover how Vectra AI empowers SOC teams to swiftly detect, analyze, and counteract cyber threats. Explore advanced investigation practices and streamlined workflows in this insightful blog by Ada Tirelli.

Explore effective strategies for managing zero-day vulnerabilities, including trend analysis, AI-based defenses, and case studies on zero-day exploits.

Some cybersecurity vendors say they provide AI but only deliver basic rule-based systems. Ask 4 questions to see if an AI in cybersecurity claim is real.

With the number of hybrid-cloud cyberattacks on the rise, SecOps teams now have a way to gain unmatched visibility into all actions taking place across the entire AWS infrastructure.

Is decrypting packet payloads operationally effective or efficient at helping defenders find signs of advanced nation state attacks or manually executed attacks like RansomOps in a network?

This new open-source tool bridges common gaps SOC teams face in cloud threat detection. Gain more flexibility to develop custom attack techniques.

Unveiling the Vectra AI Platform: Your pathway to fortified cybersecurity. Co-created with security pioneers, this innovative platform offers integrated Attack Signal Intelligence for unmatched resilience, SOC modernization, and agile response to advanced threats.

Vectra Research recently discovered a method for leveraging functionality newly-released by Microsoft to perform lateral movement to another Microsoft tenant.

In the vast and interconnected realm of the digital landscape, an insidious storm is brewing. This storm, as revealed by the Dutch National Coordinator for Security and Counterterrorism (NCTV) in their Cyber Security Assessment Netherlands 2022, is rapidly becoming the new norm: cyber and insider attacks orchestrated by nation-state actors ​(The National Coordinator for Counterterrorism and Security, 2022)​. One well-known example that exemplifies the magnitude of nation-state cyber threats is the SolarWinds cyber-attack. This incident had far-reaching consequences, creating a wave of disruption for numerous organizations.

In an era defined by rapid technological advancements, ensuring the resilience and security of our financial systems has become more crucial than ever. The Digital Operational Resilience Act (DORA), a regulatory framework introduced by the European Union (EU), stands as a beacon of progress, aiming to bolster cybersecurity and operational resilience within the financial sector. In this blog, we shall delve into the essence of DORA, while providing actionable insights to help businesses comply with this transformative legislation.

Forrester’s version of Network Detection and Response (NDR) has some serious flaws, including an obsession with decryption that’s dangerous for enterprises.

The Cambrian Explosion in large language model (LLM) AI SaaS services has opened a huge number of exciting opportunities for everyone, however there are some giant risks associated with these services. As people continue to leverage them regardless of risk — Vectra helps you track exactly who.

What do you need to know following the announcement of the integration of Vectra's Attack Signal Intelligence into Amazon Security Lake?

The recent Microsoft announcement on “Volt Typhoon” activity brings the reality of persistent threat actors back into the spotlight.

As threats become more prominent, it’s important to pose the question: what actually brings clarity? It’s a question that we can struggle with, but we may simply not be approaching it in the right way.

Discover why 91% of customers prefer Vectra AI over Darktrace, focusing on innovation, user experience, and AI-driven solutions for enhanced security.

As cloud compromises become the new normal, Cloud Detection and Response is the answer to monitor and detect suspicious behavior across cloud environments.

The NIS (Network and Information Security) Directive was the first EU-wide law on cybersecurity which came into effect in 2016. Let's summarize it for you.

Attacker techniques are dictated by the characteristics of the tech stack. So what is the approach needed to defend cloud systems?

Discover how Vectra AI, through user feedback, has improved its scoring model and user interface to provide more effective threat prioritization and an efficient workflow.

Vectra CRO Willem Hendrickx why he's excited about the opportunity ahead for AI in cybersecurity.

Vectra Match ingests intrusion detection signature context for more efficient and effective threat investigations and hunting.

Last week SentinelOne announced integrations with key industry players inclulding an enhanced collaboration with Vectra AI to expand the company’s XDR offering.

As a seasoned veteran of RSAC, Aaron Turner has curated a list of themes, must-attend sessions, and personal recommendations to consider as to navigate and prioritize your week in San Francisco.

72% of security practitioners "think they may have been breached, but don't knowit." Said differently, nearly three-quarters of security teams don't know wherethey are compromised right now.

When an analyst detects an intrusion, the most critical factor is analyzing the context of the intrusion. We do this by identifying the attacker’s tactics, techniques, and procedures (TTPs).

Recently, CISA released a new open-source tool named the Untitled Goose Tool that helps organizations investigate threats to Azure AD, M365 and Azure.

After detecting an event in the detection phase of an incident response and analyzing it in the analysis phase — you can use the automated solution for containment of the four supported AWS services.

What steps can you take to ensure that your organization is not the weakest link in the chain of critical infrastructure?

Being able to suffice multiple requirements in a single consolidated sensor relieves complexity and lowers cost. With the release of Vectra Match, a solution is now within easy reach.

Gain complete clarity on known and unknown threats across your network by combining Vectra Match signature context and the power of Vectra NDR with Security AI-driven Attack Signal Intelligence™.

This blog outlines the intel in the LastPass communiques and enumerates the attacker indicators while framing the discussion around the "Pyramid of Pain".

Recently, we investigated suspicious behavior in an environment where Azure passwordless authentication was set up. Prompting the investigations was several users were hit with unexpected Authenticator app prompts. To their credit, none of the users fell for the ruse or let the attacker in.

On February 9th 2023, a milestone partnership was celebrated between Vectra and KPMG, and they had a lot to share. The discussion centered around the value of EffectiveSecurity Observability (ESO) - powered by Vectra's Attack Signal Intelligence, while KPMG and Vectra hosted a joined webinar.

Security teams need the right tools to test cloud security controls in ways that emulate real attacker behavior to understand the gaps and ensure they have the proper visibility to stop an attacker.

When a physical threat presents itself, most people will implement protection mechanisms. When warned of an impending hurricane, people will naturally board up their property and take cover. This behavior is conditioned, but why doesn't that conditioning extend to enterprise security programs?

With KPMG's guidance and Vectra's technology, organizations can achieve greater visibility into their security posture, reduce risk and reassure the protection of their critical data.

In this blog, we'll examine known threats aimed at hybrid cloud environments and where you might be able to catch them before they become an issue.

Through harnessing Vectra's Security AI-driven Attack Signal Intelligence (ASI) for cloud, SecOps teams can continuously monitor and uncover sophisticated threats across their SaaS and cloud environments in real-time.

2022 brought a surplus of geopolitical drama and the world's first full-on cyberwar. What comes next? Here's an educated estimate.

Explore key cybersecurity predictions for 2023, including talent recruitment, nation-state threats, software labeling trends, and quantum computing challenges.

Modern cyber threats are increasingly evasive and difficult to detect. Vectra offers a new AI-driven solution: Attack Signal Intelligence.

When we enter our names, addresses, phone numbers, emails and credit card info - personally identifiable information (PII) - whose job is it to make sure that the information remains safe and not in the wrong hands? The retailer? The consumer?

Ransomware is a common type of cyber attack that may target individuals and businesses alike. Device users of any kind must be aware of the different types of ransomware attacks and how to prevent them.

Cyberattacks are still on the rise. Learn more about the problem of preventive cybersecurity and what needs to be changed.