Welcome to the Vectra Blog

Four signed drivers. Three had documented CVEs. None on the blocklist. How DragonForce used the kernel signing pipeline to disable security tools.

A year of AI-enabled attacker activity, what it tells us about where attacks are headed, and where detection holds up.

AI agents, service accounts, and automation are the new insider threat. Learn how artificial insiders create risk at machine speed.

The Security Event Horizon explains where prevention ends and detection, context, and response become critical to stopping attacks.

Security teams aren’t short on exposure management tools. There are asset inventories, vulnerability scanners, EDR, cloud security platforms, identity systems, attack surface management (ASM) platforms, and SIEMs. Each one provides a piece of insight into the environment.

Modern attackers evade decryption, reputation checks, and beacon detection. Learn how Vectra AI uses behavioral AI to detect hidden command-and-control activity.

Explore five key Gartner SRM 2026 trends shaping cybersecurity, from AI-driven defense and identity security to cyber resilience.

Conti to The Gentlemen: four ransomware leaks, four years. The operators evolved. The gaps stayed exactly where they were. What CISOs should do next.

Discover how Zscaler and Vectra AI deliver modern network protection with Zero Trust, AI-driven detection, and unified visibility.

Azure’s Hidden Operators: A Threat Model for Platform-Level Managed Identities

AI isn't new to Vectra AI. Discover why we're making it more visible now and what it means for modern cybersecurity.

A Vectra AI CEO perspective on the 2026 Gartner Magic Quadrant for NDR, and what it reveals about the future of AI-driven network security.

AI adoption is no longer a future planning exercise. It's happening inside the AI Enterprise.

Learn how Vectra AI’s Investigate API delivers security telemetry and evidence into SIEM and SOAR workflows for faster investigations.

Learn why SIEM and SOAR integrations fail and how Vectra AI improves security automation with context-rich alerts and reliable workflows.

TeamPCP open-sourced Shai-Hulud today. The OIDC token extraction technique that made the TanStack attack different from every previous campaign is now a public toolkit.

Learn how Vectra AI improves SIEM and SOAR workflows with behavior-driven signal, investigation-ready telemetry, and better security orchestration.

ShinyHunters isn't a single group. It's a pattern of attacks where authentication succeeds. Here's how to detect them before the data warehouse.

Learn how Vectra AI uses AI to secure the AI enterprise—reducing risk, accelerating detection, and enabling faster, more confident response.

AI agents are becoming the new workforce, and a new attack surface. Learn the risks they introduce and how to maintain visibility and control at AI speed.

Why Modern Threat Scoring Must Reflect Attacker Progression

Claude Mythos and GenAI are reshaping security — discover why faster exploits, endless patching, and resilient detection now define defense.

Identity-based attacks are increasing across hybrid environments. Learn how to detect compromised identities before attackers move laterally.

Claude Mythos accelerates risk—not just hype. Learn what CISOs must focus on now: visibility, speed, and understanding attacks as they unfold.

This blog explains how Microsoft's shift from the legacy Azure Diagnostics Agent to the Azure Monitor Agent fundamentally changes how VM logging is controlled and highlights how this redesign can introduce detection blind spots if security teams don't update their monitoring approach.

Three leaked Windows Defender exploits are now hitting real enterprise targets. Here is what the attack chain looks like, why endpoint tools alone cannot contain it, and where the Vectra AI Platform with RUX surfaces it before the damage is done.

AI-assisted search lets analysts ask investigative or hunting questions in plain language.

Discover four key ways AI can enhance SOC efficiency by improving alert accuracy, optimizing investigations, automating threat hunting, and prioritizing high-risk threats.

If you ask security analysts to describe the biggest pain points in their role, you will no doubt get a diverse set of answers. One thing that they will almost certainly have in common is the challenge of dealing with alert fatigue.

Identity and network are the new control points in cybersecurity. Learn why securing them is critical for visibility, detection, and resilient defense.

Attackers bypass MFA using non-interactive sign-ins. Learn how to detect and stop credential-based threats before they escalate.

Another supply-chain breach hit SaaS in April 2026 — Anodot tokens used to access Snowflake. Why the same ShinyHunters-branded pattern keeps repeating, and what makes the MO hard to detect.

We took a deep dive into millions of detections across MDR/MXDR and Respond UX deployments with the goal of getting a clearer picture of where the real threats are so that we can get a better understanding how security teams can work smarter, not harder.

EDR alone can’t stop modern breaches. Learn why CISOs are uniting network and identity signals to outpace attackers and build resilience.

Compromise of endpoint management systems changes the attack path entirely. Learn how control-plane attacks bypass early detection and why behavior across identity, network, and endpoints is the only reliable signal.

The axios supply chain compromise shows why risk begins after execution. Learn how to detect post-compromise behavior across CI/CD pipelines, identity systems, and network activity.

Can you confidently answer who is doing what on your network? Learn why visibility into user activity is key to security, risk, and compliance.

A compromised npm package is only the entry point. The axios incident shows how quickly attackers pivot from code execution to credential abuse, identity misuse, and cloud access.

Detect how Sliver C2 evades traditional beacon detection and how behavioral AI identifies command-and-control activity hidden in encrypted traffic.

Prompt control turns AI agents into command-and-control systems by manipulating context, memory, and inputs—enabling persistent, stealthy attacker control through normal agent behavior.

Learn how attackers move laterally across hybrid networks, abusing identity, credentials, and legitimate tools to reach critical systems before launching ransomware or stealing data.

Learn how attackers maintain hidden access inside hybrid networks and how SOC teams can detect persistence before it leads to data theft or ransomware.

Inside the Stryker incident: how Handala likely moved from identity access to disruption, and the identity, scripting, and data transfer signals SOC teams should watch.

Cyber resilience is lagging as defenders face alert overload, visibility gaps, and AI-speed attacks. Learn what SOC teams must change to stay resilient.

Detect Iranian APT activity across identity and network telemetry with six practical threat hunts. Run ready-to-use queries in the Vectra AI Platform to uncover credential abuse, C2 infrastructure, and early compromise signals.

AI-powered attacks are accelerating with agentic AI, but network behaviors remain visible. Learn why AI-powered NDR detects and stops these threats.

AI traffic now hides autonomous, agentic attacks. Learn how MCP-enabled swarms blur legitimate AI activity and command and control, reshaping detection and defense.

An AI-driven AWS attack reached admin access in minutes using valid credentials. Learn how identity abuse and automation compress cloud attack timelines.

UX teams must translate attacker behavior—not alerts—to help SOC teams act on AI-driven threats that move at machine speed.

Molt Road reveals how attacker marketplaces could evolve when autonomous agents trade services, coordinate attacks, and remove humans from the loop.

Moltbook exposes how autonomous AI agents turn trust and interaction into attack paths, enabling prompt injection, lateral movement, and covert command and control.

Gartner redefines NDR—and Vectra AI agrees. Learn why true resilience starts with understanding risk, not just detecting anomalies.

Clawdbot – now Moltbot – shows how autonomous AI agents become shadow superusers, enabling initial access, lateral movement, and ransomware when trust is abused.

AI moves fast—leaders must move smarter. Vectra AI’s CEO shares how to balance innovation with resilience in today’s machine-speed enterprise.

AI agents are accelerating the kill chain faster than defenders can respond. See what changes in 2026 and where SOCs fall behind.

Threat actors try to stay invisible, but OPSEC mistakes keep exposing them. A look at real-world failures and what they reveal about human error and AI-driven attacks.

AI is no longer assisting attackers, it is running the operation. A deep look at how threat actors moved from experimentation to autonomous, AI-driven cyberattacks.

CVE-2025-14847 ‘MongoBleed’ exposes critical memory leaks—learn how Vectra AI detects vulnerable MongoDB instances across your network.

Pro-Russia hacktivists are disrupting critical infrastructure by abusing legitimate access. Learn how these OT attacks work and why traditional tools miss them.

Vectra AI instantly connects network detections to endpoint processes—no pivots, no delay, just complete attack context in one view.

See how Vectra AI and CrowdStrike unite EDR and NDR to deliver full attack context, faster investigations, and clearer, more decisive threat response.

You are the Blackboard - AI Agent Assisted Bug Hunting

TCP resets don’t stop modern attackers. Learn why they fail—and how Vectra AI’s 360 Response delivers true, enforced containment across identity, device, and traffic.

How the Shai-Hulud worm hijacked trusted development tools and why defenders need behavioral visibility to catch the attack after the first package is installed.

Chinese state-backed Typhoon APTs infiltrate networks using trusted tools. Learn how the Vectra AI Platform detects their stealthy, persistent behavior.

Microsoft prevention isn’t enough. Learn how attackers exploit gaps across Azure, M365, and Entra ID—and how Vectra AI delivers the visibility to stop them.

Europol seized 1,000+ servers and €21M across three phases targeting initial access brokers. Criminal groups rebuilt within days — static defenses cannot keep up.

Discover insights from 400+ NDR power users on how network visibility closes security gaps, boosts SOC efficiency, and speeds threat response.

Learn how attackers gain initial access to your hybrid network, and how to stop intrusions before they turn into breaches.

Vectra AI tests how LLMs like GPT and Claude perform in real SOCs—revealing which AI agents truly think, act, and reason in cybersecurity.

Transform SOC efficiency with AI-driven threat hunting. Detect stealthy attacks earlier, cut MTTR, and operationalize Gartner’s 2025 recommendations.

Introducing the Vectra AI MCP Server for QUX—bringing AI-powered SOC automation and MCP innovation to on-premises security environments.

From Conti to Black Basta to DevMan, ransomware code keeps resurfacing. See how behavioral AI detects the attacker behaviors that rebrands cannot hide.

The F5 compromise shows how attackers abuse trusted edge systems. Behavioral detection spots hidden persistence where perimeter tools fail.

Qilin’s 2025 variants use MFA bombing, SIM swapping, and AES-256-CTR encryption to evade detection. Discover how the Vectra AI Platform exposes their behavior before encryption starts.

Vectra Fusion unifies observability and detection to build SOC resilience before and after compromise across hybrid environments.

Crimson Collective says defenders only “map the coastline.” See how Vectra AI dives deeper, turning cloud and identity telemetry into real-time detection of hidden threats.

The Cl0p ransomware group’s link to the Oracle EBS exploit sparks debate. Learn how supply chain attacks evolve and what defenders must do next.

Not all NDR tools cover hybrid networks equally. Identify capabilities that matter for detection and control.

The Crimson Collective claims to have stolen Red Hat consulting data, exposing customer engagement reports. Learn why consulting artifacts are prime attacker targets and how Vectra AI helps close the gap.

Patching stops entry, but not attacker behavior. See how detection closes the post-exploitation gap

Vectra AI and Netography deliver the first converged SOC platform, uniting prevention and response for resilience across hybrid enterprises.

Discover how BRICKSTORM hid for 400 days in enterprise blind spots and learn how Vectra AI closes detection gaps across network, identity, and cloud.

EDR stops at endpoints. SIEM reconstructs after the fact. See why NDR fills the detection gap where attackers operate

Scattered Lapsus$ Hunters may claim they’re gone, but The Com endures. Cybercrime has moved beyond ransomware into an era where extortion is the goal.

LockBit is back with version 5.0. Discover its new features, TTPs, and how SOC teams can detect attacks where prevention alone falls short.

Poisoned npm packages are just the entry point. Discover how attackers move next and why SOC teams must detect behaviors beyond the initial exploit.

AI is accelerating cybercrime — from ransomware kits to insider fraud. Learn how attackers exploit security gaps and how Vectra AI helps you detect what others miss.

Hunt for risky multi-tenant apps in Microsoft 365. Learn how attackers exploit consent-based access and how to detect misconfigurations in minutes.

Discover how GLOBAL RaaS empowers affiliates with enterprise-scale ransomware features, and how Vectra AI detects threats others miss.

Nation-state campaigns bypass prevention controls. Learn why post-compromise detection is now critical

Explore how MCP-powered agent swarms evade detection, bypass EDR, and exploit LLMs for stealthy attacks. A new era of autonomous C2 is here.

Discover how Scattered Spider, Volt Typhoon, Mango Sandstorm, and UNC3886 evaded defenses - and why SOC teams need NDR to stop them in time.

DLP and EDR miss insider misuse. Learn behavioral indicators and how detection identifies risk before damage

What different stakeholders looking for an NDR asked the Vectra AI team at BlackHat 2025.

Vectra AI and Google Security Operations unite to break security silos, streamline workflows, and strengthen threat detection and response.

Modern attacks often begin with valid credentials and evade detection. Learn what questions to ask vendors about post-compromise visibility.

Key takeaways from Black Hat USA 2025 on defending modern networks from AI-driven threats, identity attacks, and converged risks.

Vectra AI MCP Server brings AI-native security—faster threat detection, investigation, and response with natural language prompts.

Threats are not uniform. The most critical threat in one cloud may be a non-issue in another. Defenders and researchers must tailor their strategies, recognizing that there is no “1-to-1” approach to security controls in a multi-cloud environment.