Gurucul

The biggest insider risks do not always come with obvious warning signs.

A trusted employee accesses a sensitive system at an unusual time. A privileged user begins interacting with data they rarely need. An account shows a pattern of activity that looks normal in isolation but becomes concerning when viewed in context.

This is the challenge with insider risk.

Traditional security tools can identify known indicators and policy violations, but insider threats often involve legitimate identities, authorized access, and actions that do not immediately look malicious.

That is why behavioral context matters.

AI-powered insider risk management can help security teams understand how users, identities, and entities normally behave and identify meaningful deviations that may require investigation.

The goal is not to treat every unusual action as malicious. It is to provide the context security teams need to distinguish normal business activity from behavior that could signal growing insider risk.

With behavioral analytics and AI-driven risk detection, organizations can gain greater visibility into suspicious access, privilege misuse, unusual data activity, and other behaviors that may otherwise remain hidden among routine operations.

Insider risk is often a context problem before it becomes a security incident.

See how Gurucul AI-Powered Insider Risk Management helps security teams detect and investigate hidden insider risk:

https://gurucul.com/products/ai-powered-insider-risk-management/

Cyber threats are increasingly exploiting trust at every stage of the digital ecosystem, from online shopping offers and advertising platforms to enterprise applications.

Our latest threat intelligence coverage examines three campaigns that highlight very different risks for individuals, organizations, and security teams.

A shipping rebate offer may appear harmless, but deceptive subscription and payment schemes can turn attractive promotions into recurring financial charges. This type of campaign highlights the importance of recognizing the difference between legitimate offers and deceptive online activity.

http://gurucul.com/latest-threats/that-shipping-rebate-offer-may-come-with-a-monthly-charge/

Threat actors are also using Google Ads to target Ledger users. Malicious advertising can place deceptive content directly in front of people searching for trusted products or services, creating opportunities for credential theft, fraud, and cryptocurrency related attacks.

https://gurucul.com/latest-threats/threat-actors-use-google-ads-to-target-ledger-users/

Meanwhile, ShinyHunters has renewed mass exploitation activity targeting Oracle PeopleSoft. The campaign highlights the continued risk facing enterprise applications that hold sensitive business data and support critical organizational processes.

https://gurucul.com/latest-threats/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/

These campaigns demonstrate why security teams cannot look at threats in isolation.

Attackers continue to abuse trusted brands, trusted advertising platforms, and widely deployed enterprise technologies to reach their targets.

For security leaders, SOC teams, threat hunters, and risk professionals, threat intelligence provides essential context for understanding how these campaigns operate and where exposure may exist.

Continuous monitoring, behavioral analytics, application security, and user awareness remain important layers of a modern defensive strategy.

The challenge is not simply identifying known threats.

It is recognizing when trusted digital channels are being abused.

AI is moving fast across the enterprise, but do you know which AI tools, agents and services are already active in your environment?

The Gurucul AI Risk Discovery Assessment helps security, insider risk and AI teams discover sanctioned and unsanctioned AI activity using telemetry they already collect.

The assessment connects AI activity to users, endpoints, departments and non human identities, helping security teams identify unusual activity, policy restricted providers, unexpected upload behavior, unowned identities and other signals that may require attention.

No new endpoint agent, browser extension or AI provider integration is required to start. The assessment typically requires less than an hour of hands on time from your team and provides a prioritized report with recommended next steps.

The real question is no longer whether employees and systems are using AI.

It is whether your security team can see, understand and prioritize that AI activity.

Explore the AI Risk Discovery Assessment:
https://gurucul.com/ai-risk-assessment/

Akira ransomware continues to demonstrate how modern ransomware operations can create business risk well beyond system encryption.

Our latest analysis examines Akira’s attack velocity, victim trends, geographic and industry exposure, associated CVEs, MITRE ATT&CK techniques, and double-extortion tactics across enterprise environments.

For executive leadership, the key issue is not simply whether an organization can prevent encryption. It is whether security, identity, vulnerability management, data protection, and incident response capabilities can collectively reduce the impact of an intrusion.

Understanding how Akira operates can help security leaders prioritize exposure management, strengthen ransomware resilience, and align cyber risk decisions with business continuity objectives.

Read the full analysis: https://gurucul.com/blog/inside-akira-ransomware-analyzing-attack-velocity-exploited-cves-and-double-extortion-tactics/

AI is rapidly becoming part of the enterprise operating environment. Employees are using AI applications, organizations are deploying AI agents and models, and these systems increasingly interact with sensitive data, business applications, identities, and critical infrastructure.

For security leaders, the challenge is no longer simply knowing that AI is being used. The greater challenge is understanding what AI is doing, who or what is behind that activity, what it can access, and whether its behavior represents meaningful risk.

Gurucul AI Risk and Response is designed to provide that context.

The platform connects AI activity with the people, machines, identities, access, applications, and data surrounding it. This enables security teams to establish a clearer view of AI exposure across both sanctioned and unsanctioned environments, including AI applications, agents, models, tools, and MCP connections.

What makes the approach particularly relevant for enterprise security is the combination of known threat detection, Behavioral AI, and entity relationships. Rather than treating every AI event as an isolated alert, Gurucul evaluates changes in behavior, access, peer activity, data sensitivity, and relationships to help identify risk as it develops.

The platform also provides evidence backed risk scoring, helping analysts understand why risk has changed and which activity contributed to that assessment. This creates a more contextual risk picture across users, agents, accounts, endpoints, and affected resources.

Gurucul AI Risk and Response is also agentless, allowing organizations to use identity, endpoint, network, cloud, and AI platform telemetry they already collect rather than requiring another endpoint or browser agent.

For enterprise security leaders, this creates a more practical way to address an emerging challenge: gaining visibility into AI adoption while maintaining control over risk, access, data, and response.

And importantly, response remains governed by the organization. Analysts can review the evidence, confirm scope, determine the appropriate action, and apply configured controls while maintaining human oversight over consequential decisions.

As AI becomes increasingly embedded in the enterprise, understanding AI risk requires more than visibility. It requires context, behavioral intelligence, evidence, and controlled response.

Discover Gurucul AI Risk and Response:

https://gurucul.com/products/gurucul-ai-risk-and-response/

AI has moved beyond generating answers. It is increasingly taking action across the enterprise.

AI agents can access tools, use credentials, interact with systems, move data, and operate with limited human intervention. This creates a fundamentally different security challenge for enterprise leaders.

The question is no longer simply where AI is being used. Leaders need visibility into which people and AI agents are acting, what access they have, what they are doing, whether that behavior is expected, and how risk is changing over time.

This is where AI security becomes an enterprise risk and governance issue.

Gurucul AI Risk and Response extends Unified Entity Intelligence to AI agents, giving SecOps and Insider Risk teams the context needed to understand AI activity alongside identities, permissions, systems, tools, data access, and behavioral changes.

The goal is not to restrict enterprise AI adoption. It is to provide the visibility and control required to adopt AI responsibly while identifying behavior that may introduce material security risk.

As organizations move from AI assistants toward autonomous agents, security strategies must evolve from monitoring AI usage to understanding AI behavior.

AI is becoming an active participant in the enterprise. Security needs to be prepared for that shift.

Learn more: https://gurucul.com/blog/ai-stopped-answering-and-started-acting-security-has-to-catch-up/

AI is moving from generating answers to taking action. That changes the risk equation for every enterprise.

As Saryu Nayyar, CEO of Gurucul, puts it, “Risk no longer lives within a single prompt or application. It develops across identities, permissions, data, tools and actions over time.”

This is the shift behind Gurucul’s launch of AI Risk and Response, now generally available to help security teams understand AI activity in the broader context of the enterprise.

For CISOs and security leaders, visibility into AI usage is only the starting point. The greater challenge is understanding who or what is acting, what that activity can access, how behavior is changing and where emerging risk requires action.

Gurucul AI Risk and Response brings behavioral AI, identity, access, data and security telemetry together to help SOC and Insider Risk teams identify Shadow AI, excessive access, sensitive data exposure and risky autonomous agents.

With runtime prevention now in preview, organizations can also take the next step toward stopping selected high-risk AI activity at the point of interaction.

As AI becomes increasingly capable of acting across enterprise environments, security leadership needs a way to understand not just what AI is asked to do, but what it actually does and the risk that behavior creates.

Read the full press release: https://gurucul.com/press-releases/gurucul-launches-ai-risk-and-response-to-detect-and-stop-risky-ai-behavior-before-it-escalates/

What happens when an AI agent inherits an instruction that changes what it does next?

As AI agents become more capable and increasingly connected to data, tools, identities, and business systems, security teams face a new challenge: understanding not only what an agent receives, but what it does with that inherited context.

A harmless looking note, persistent memory, configuration change, repository entry, or agent to agent message can become a security concern when it influences behavior across systems and over time.

The security signal is not always found in the inherited instruction itself. It can emerge in the behavior that follows.

Did the agent stop using tools it normally uses? Did it access data outside its expected role? Did its activity change from its established pattern? Did it begin using credentials, systems, or destinations in an unfamiliar way?

These changes do not automatically indicate an attack. They are signals that require context and investigation.

Our latest research explores why understanding agent identity, delegated access, behavioral baselines, and activity across handoffs is becoming increasingly important as organizations adopt agentic AI.

Read the full analysis:

https://gurucul.com/blog/when-ai-agents-leave-notes-for-each-other/

The enterprise attack surface is expanding beyond traditional endpoints.

Three recent threat developments show how attackers are exploiting exposed infrastructure, trusted software delivery channels and unpatched enterprise technology.

Redis instances abuse shows how internet-exposed Redis infrastructure can become a foothold for P2PInfect, enabling remote code ex*****on, further scanning, persistence and potentially cryptocurrency mining or ransomware activity.

MovieReaper demonstrates how compromised torrent infrastructure can distribute malware disguised as legitimate movie downloads. Its multi-stage infection chain is designed to establish access while avoiding security and sandbox detection.

Chrome and Windows zero-day exploitation highlights another challenge. State-linked actors are using browser and operating system vulnerabilities to gain access, bypass security boundaries and potentially compromise active sessions.

For CISOs and enterprise security leaders, the common thread is clear. The threat is not limited to a vulnerability, a malicious file or an exposed service. It is the behavior that follows the initial compromise.

Security teams need to connect infrastructure activity, endpoint behavior, identity signals and network context to understand what is happening before an isolated event becomes an enterprise incident.

See the signal. Understand the behavior. Respond before the impact spreads.

Read the full research:

https://gurucul.com/latest-threats/redis-instances-abuse/

https://gurucul.com/latest-threats/the-odyssey-and-trojans-again-moviereaper-attacks-users-in-multiple-countries-via-compromised-torrents/

https://gurucul.com/latest-threats/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/