Threat Detection | Breaking Cybersecurity News | The Hacker News

A security leader at a global finance company told us recently that his team discovered three times more AI tools running in their environment than IT had approved. Nobody had smuggled them in. Employees had simply pointed agents at their work, and the agents brought their own tools with them. That conversation is not unusual. It is the conversation. Over the past year, in customer discussions across finance, healthcare, manufacturing, and government, the same four struggles come up so consistently that we have started treating them as the shape of the problem itself. Every company effectively hired a second workforce this year, human workers and agentic workers side by side, and the agentic workers never went through onboarding. No handbook, no scoped credentials, no acceptable-use policy they can actually read. Here is what teams are struggling with, what our research says about why, and what closing each gap actually requires. Struggle one: "I can't tell you what age...

When it comes to email security software, the cybersecurity industry has become very good at one thing: scoring the message that's already in the inbox. We've gone from blocklists to signature matching to behavioral ML, and each generation of email security innovation was a genuine improvement over the last.  But the losses keep climbing anyway. The median time it takes someone to click a phishing link is just 21 seconds after opening the email, and another 28 seconds to hand over credentials or payment data. That's under a minute start to finish. That number hasn't moved much in years despite everything we've thrown at the problem. It's time for a different approach. But first, we need to understand modern challenges. We're filtering messages, but attackers are running campaigns By the time a phishing email actually lands in someone's inbox, the attacker has usually finished the hard part. They've registered a lookalike domain and gotten it a vali...

Somewhere right now, malware running on a compromised machine is checking in with an AI model, asking it for a new version of itself. Google's Threat Intelligence Group caught this happening in late 2025. The malware, nicknamed PROMPTFLUX, does this every hour it runs, and each version comes back looking different from the last. By the time a security tool learns to recognize it, it has already changed shape again. This isn't a rare glitch or a lab experiment. It's a preview of how a growing share of attacks work today and why legacy SIEM platforms built to detect known patterns are starting to fall behind. Legacy security tools were built to detect, not to adapt A SIEM is a system that collects logs from every part of a company's network and looks for signs of an attack. For years, it worked like a security guard with a very long memory. The guard learns what a break-in looks like - a certain kind of file, a pattern of behavior, a code signature, and watches fo...

Security is fundamentally about knowing what a system is supposed to do, then catching it when it does something else. For software with deterministic execution paths, that is a tractable problem. For AI agents, it is not. An agent does not follow a fixed code path. It reasons toward a goal, selects tools based on that reasoning, and adapts its next action based on what those tools return. The same input can produce a different sequence of actions depending on context, session history, and what an external tool happened to return. Behavior is the attack surface, and behavior changes. Traditional proxies and AI firewalls were built to inspect content: what a user sent, what a model returned. Intent security asks a different question: is this agent doing what it was built to do, in this context, for this user, right now? Answering that requires building a behavioral baseline for every agent and measuring deviation from it continuously. That is the problem Lasso was built to solve....

The most important cybersecurity impact of artificial intelligence is not that attackers can write better phishing emails or automate parts of their workflow. It is that AI is changing the speed, scale, and decision-making dynamics of cyberattacks.  That creates a problem many organizations have not yet fully confronted: most cyber governance and incident response models were designed for human-speed attacks.  For years, security teams operated under a familiar sequence. Detect suspicious activity. Investigate. Validate the threat. Escalate to leadership. Decide on containment. Communicate with stakeholders. That model still has value, but it assumes defenders have enough time to build confidence before taking material action.  AI-enabled attacks challenge that assumption.  Adversaries can now use AI to accelerate reconnaissance, generate highly personalized social engineering, modify malware, test payloads, summarize stolen data, identify vulnerabilities, a...

New Bitdefender research reveals that 97.7% of respondents now use endpoint detection and response (EDR). That number might seem high compared to commonly accepted market penetration estimates, particularly for mid-market organizations. But it is further confirmation that the vast majority of businesses have already upgraded their endpoint protection. This is hardly surprising. The conversation in enterprise security is no longer just about blocking malware or stopping known threats. It is about "proving" that an organization can detect, investigate, and respond to modern attacks before they escalate into operational disruption, financial loss, or reputational damage. This shift was driven by a new reality: endpoint protection alone is no longer enough. The laggards, typically mid-market organizations with lean IT and security teams, are now realizing this. Threat actors are AI-enabled, more evasive, and increasingly successful at bypassing traditional defenses. At the...

Phishing emails have reached a point where they can fool both people and the tools designed to stop them. For anyone working through a packed inbox, it's easy to trust what looks familiar and click without a second thought. What's worrying is that phishing is rarely the end goal. It's usually the entry point for something much bigger: a ransomware attack. Once attackers gain access, they don't act immediately. They move through systems, map connections, and prepare the environment. By the time ransomware is deployed, it's the final step — not the first. To stay ahead, you need protection at two critical points. An advanced email security solution that catches even the most stealthy phishing attempts, and a strong BCDR strategy that lets you restore data quickly and avoid paying a ransom if something slips through. Why phishing remains so effective Phishing works because it plays on human behavior. Email may seem like a simple communication tool, but it functions as a decision-mak...