Radiant Security | Breaking Cybersecurity News | The Hacker News

Every few years, a breach happens that security teams study for the wrong reasons. SolarWinds is a good example. When the compromised Orion update started reaching customer environments in early 2020, the signals were already there: unusual DNS requests, unexpected authentication behavior in Azure AD, odd SAML token activity, and lateral movement from on-premises Active Directory into cloud environments.  None of it looked like an attack. Each signal sat at low or medium severity, and they were scattered across domains. The attackers had close to a year of dwell time before FireEye, a victim itself, discovered the breach while investigating a stolen red-team toolkit. We tend to call SolarWinds a one-off. It wasn't.  The real lesson from that breach, and from the ones that have followed it, is structural.  SOCs are designed, staffed, and measured around routine work: phishing, endpoint detections, and user anomalies. The people, processes, dashboards, and tools are ...

You invested in a new AI-SOC because you want your organization to be safe. You also don't want your SOC team to burn out from the flood of alerts they're receiving.  It's good at first. At deployment, the detections are lined up with your environment. Your SOC team reports it's going to be a learning curve, but it seems to be working. It's going well until a few months later, when it's not, at least not as well.  The problem is that the agent isn't processing alerts the way your team needs it to. It keeps flagging the CEO's logins as threats because it doesn't understand that he's traveling. It's also let a few real threats slip through the cracks. Threats that should have been easily caught. What's happening?  Pre-trained AI was built to recognize the familiar, and it does. It's trained on old data, old attack paths, and assumptions that made sense in the lab based on what's been observed before. What it can't do is understand the small, real-world details that an...