Blog

One attack in Part 2 threw off four separate alerts, and the obvious fix, one investigation agent per alert, rebuilds every failure of the overloaded human SOC at machine speed and cost. Part 3 of the Building the Agentic SOC series lays out the alternative: every related alert attaches to one linked case, worked by a small set of specialized agents, a dispatcher and case leader, over one shared model of the case and the environment.

An AI agent given a single leaked AWS key escalated from a low-privileged Lambda user to full account takeover in under 25 minutes, wrong turns included. Part 2 of the Building the Agentic SOC series walks through the attack step by step, from credential theft to a brute-forced admin identity, to show exactly what the agentic SOC has to detect and stop.

Security Architects are measured on how well they design defense, almost never on how well the SOC can respond to what that design misses. As AI turns the SOC from an organization into a system of agents, closing that gap becomes an architecture problem, and the Security Architect is the only one positioned to own it. Part 1 of a series building an agentic SOC hands-on with the open-source CDRGoat project.

Most detection content catches persistence techniques as they happen. But what if the attacker was already there before you connected your logs? CloudTwin™ analyzes Entra ID configuration state — not just log events — to answer the question every SOC team should be asking: "Have I been pwned?"

Shai-Hulud - the self-propagating npm/PyPI supply-chain worm - is now open source on GitHub, and copycats are already forking it. If your detection strategy depends on recognizing this specific malware, you've lost the next round. The right question is how to detect stolen credentials being used abnormally - invariant across every variant past and future.

Stream now collects and analyzes full API traffic via our eBPF sensor and cloud-native log ingestion, with threat detection running across all of it.

Stream.Security is expanding workload protection with Response Actions, enabling security teams to contain threats directly from the Investigator UI in real time using the same lightweight eBPF agents already deployed for detection.

AI agents and tools won't scale security until the environment itself is modeled. Real context isn't enrichment — it's a live representation of state. That shift changes what tools, harnesses, and agents actually mean, and what StreamForce is built on.

A critical Linux kernel vulnerability (CVE-2026-31431, "Copy Fail") allows an unprivileged process to corrupt any file's in-memory copy without writing to disk. In Kubernetes, this means an attacker in one pod can inject malicious code into binaries used by other pods on the same node - without any special permissions, without container escape, and without leaving a trace on the filesystem. We validated this on a live EKS cluster and built runtime detection for it.

AI workloads are dynamic, abstracted, and deeply embedded into modern applications, making them hard to track with traditional security tools. This creates a growing “shadow AI” problem where models, agents, and tools operate without oversight. Our AI workload discovery solves this by continuously analyzing cloud-native logs and runtime signals to identify all AI components in your environment—including hosted services, models, tools, and MCP servers. Each component is correlated to the workload executing it, the identity behind it, and its behavior over time. By baselining this activity, security teams can quickly spot anomalies such as new models, unauthorized integrations, or unusual usage patterns. More importantly, this visibility feeds directly into detection and response, enabling full attack storylines that include the AI layer.