Blog

In a live run of the Part 2 attack, Stream.Security's AI SOC detected the compromised key, reconstructed the full attack chain including a hidden persistence backdoor, and deleted the stolen credential on its own, stopping the attack in about ten minutes with no human in the loop. Part 4 of the Building the Agentic SOC series is about the decision that made that safe: which response actions a human lets an AI agent take autonomously, and why that call belongs to the Security Architect.

One attack in Part 2 threw off four separate alerts, and the obvious fix, one investigation agent per alert, rebuilds every failure of the overloaded human SOC at machine speed and cost. Part 3 of the Building the Agentic SOC series lays out the alternative: every related alert attaches to one linked case, worked by a small set of specialized agents, a dispatcher and case leader, over one shared model of the case and the environment.

An AI agent given a single leaked AWS key escalated from a low-privileged Lambda user to full account takeover in under 25 minutes, wrong turns included. Part 2 of the Building the Agentic SOC series walks through the attack step by step, from credential theft to a brute-forced admin identity, to show exactly what the agentic SOC has to detect and stop.

Security Architects are measured on how well they design defense, almost never on how well the SOC can respond to what that design misses. As AI turns the SOC from an organization into a system of agents, closing that gap becomes an architecture problem, and the Security Architect is the only one positioned to own it. Part 1 of a series building an agentic SOC hands-on with the open-source CDRGoat project.

Most detection content catches persistence techniques as they happen. But what if the attacker was already there before you connected your logs? CloudTwin™ analyzes Entra ID configuration state — not just log events — to answer the question every SOC team should be asking: "Have I been pwned?"

Shai-Hulud - the self-propagating npm/PyPI supply-chain worm - is now open source on GitHub, and copycats are already forking it. If your detection strategy depends on recognizing this specific malware, you've lost the next round. The right question is how to detect stolen credentials being used abnormally - invariant across every variant past and future.

Stream now collects and analyzes full API traffic via our eBPF sensor and cloud-native log ingestion, with threat detection running across all of it.

Stream.Security is expanding workload protection with Response Actions, enabling security teams to contain threats directly from the Investigator UI in real time using the same lightweight eBPF agents already deployed for detection.

AI agents and tools won't scale security until the environment itself is modeled. Real context isn't enrichment — it's a live representation of state. That shift changes what tools, harnesses, and agents actually mean, and what StreamForce is built on.

A critical Linux kernel vulnerability (CVE-2026-31431, "Copy Fail") allows an unprivileged process to corrupt any file's in-memory copy without writing to disk. In Kubernetes, this means an attacker in one pod can inject malicious code into binaries used by other pods on the same node - without any special permissions, without container escape, and without leaving a trace on the filesystem. We validated this on a live EKS cluster and built runtime detection for it.