David Greenwood

Attackers exploited PHP2Shell four days before the patch arrived, showing why security teams can no longer wait for disclosure to start investigating.

Stolen credentials can pass through several hands before an attacker uses them to access your organization, and each step leaves clues security teams can act on.

One SOC can protect dozens of customers, but every customer works differently. See how multi-level agents give security teams one shared way to investigate alerts, while keeping the local context needed to make the right call.

AI SOC agents need more than an alert to investigate threats. See how telemetry, asset data, identities and threat intelligence help explain each verdict.

A convincing demo doesn’t prove production readiness. Learn how to test an AI agent before it takes on live SOC investigations.

A detection can raise the alarm and still leave the analyst with the hardest work. Runbooks put the investigation path beside the alert.

Security teams do not struggle with a lack of data. They struggle with a lack of context.

Traditional SOC rules miss attacks using valid accounts and MFA fatigue. Learn real-world cases where UEBA detects stealthy lateral movement, OAuth abuse, and cloud console misuse.

Shadow IT isn’t just governance debt, it’s an attacker’s beachhead. This post explores real intrusions where forgotten assets, rogue tenants, exposed cloud storage, and abandoned domains enabled initial access, and why closing visibility gaps is now a core SOC capability.

Explore the impact of Agentic AI in SOC operations and how it boosts efficiency and effectiveness for SOC teams.