Cybersecurity Operations | Breaking Cybersecurity News | The Hacker News

Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For the teams still testing, the next decision is whether their own SOC is ready. AI SOC readiness has two parts: whether a SOC has the problems AI SOC agents are built for, and whether it has the data access, context, written standards and oversight rules that AI agents need to investigate alerts accurately in its environment. A SOC does not need to be far along a maturity model to be ready. AI agents do their first work on the bottom layer, alert handling, and the analyst hours they return give a team room to work on the layers above it. The next section describes those problems. Technical readiness covers four areas: access and context, an investigation standard with baseline metrics, rules for what the agent may do, and a...

The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.  Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application the business depends on. Without evidence, the recommendation waits.  Safe remediation answers that hesitation with evidence. It tests the proposed action against your environment, applies the approved change, and confirms the result. Security and operations teams decide together, with facts.  The Cost of Leaving Protection in Detect  Many organizations already own protection they don’t enforce. Signatures sit inactive or in Detect mode while teams weigh false positives, inspection capacity, and business continuity. Meanwhile, applications and traffic patterns change, excep...

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion through a series of smaller alerts that are triggered (e.g., when a signature matches a known malware hash, a threshold flags an unusual spike in failed logins, or an endpoint agent detects suspicious activity). When viewed through the SIEM dashboard, an attack often begins as a series of distinct events with related or overlapping timestamps. Artificial intelligence has accelerated modern attacks, enabling attackers to automate reconnaissance, craft targeted payloads, and execute scripts in seconds. Yet, speed does not obfuscate the need for stealth. To evade detection, adversaries deliberately d...

As threat complexity increases and the boundaries of an organization have all but disappeared, security teams are more challenged than ever to deliver consistent security outcomes. One company aiming to help security teams meet this challenge is  Stellar Cyber .  Stellar Cyber claims to address the needs of MSSPs by providing capabilities typically found in NG-SIEM, NDR, and SOAR products in their Open XDR platform, managed with a single license. According to Stellar Cyber, this consolidation means faster security analyst ramp time and customer onboarding with far less manually intensive tasks required. Stellar Cyber currently counts 20+ of the top MSSP providers as customers, providing security for over 3 million assets. In addition, stellar Cyber claims after deployment, users see up to 20x faster mean time to respond (MTTR), a bold claim. We recently took a closer look at the Stellar Cyber Security Operations Platform.  Before we begin Before digging into the plat...