Gurucul

Most enterprises already collect enough telemetry to cover 90% of the MITRE ATT&CK framework, yet their actual detection coverage is only 22%.

Key takeaways:
• The challenge is not data collection. It is data routing, normalization, and enrichment.
• More log ingestion does not automatically improve detection coverage.
• Intelligent telemetry optimization can reduce SIEM ingestion costs while preserving detection visibility.
• High value telemetry should be prioritized over high volume telemetry.
• Organizations should optimize existing data before investing in additional log sources.

Read the full analysis:
https://gurucul.com/blog/most-enterprises-already-collect-enough-data-to-cover-90-percentage-of-the-mitre-attck-framework-they-cover-22-percentage/

Inside Qilin: A Comprehensive Threat Actor Profile

Qilin has evolved into one of the most active Ransomware-as-a-Service (RaaS) operations, targeting organizations across healthcare, manufacturing, finance, government, and other critical sectors. This threat actor profile provides a structured overview of Qilin's operational model, affiliate ecosystem, victimology, technical capabilities, and defensive considerations to help security teams better understand this evolving ransomware threat.

The profile covers:
✓ Threat actor overview and evolution from Agenda to Qilin
✓ Affiliate ecosystem, underground presence, and operational model
✓ Victim demographics, targeted industries, and geographic distribution
✓ Initial access, credential access, lateral movement, data exfiltration, and ransomware deployment
✓ MITRE ATT&CK technique mapping
✓ Detection opportunities for SOC and threat hunting teams
✓ Defensive recommendations and incident response considerations

Read the full profile:
https://gurucul.com/blog/threat-actor-profile-qilin/

This profile is designed for cybersecurity professionals, SOC analysts, incident responders, threat hunters, and security leaders seeking actionable threat intelligence and defensive insights.

Bank of Baroda is investigating a security incident after the Triple X threat actor claimed to possess a dataset allegedly containing customer records, KYC documents, Aadhaar and PAN details, banking information, and internal documents.

The bank has confirmed a security incident involving an employee email account and stated that its core banking infrastructure and customer transaction systems were not affected. While the authenticity and completeness of the alleged dataset have not been independently verified, the incident serves as a reminder of the increasing threat posed by cybercriminal groups targeting financial institutions for sensitive customer data.

In our latest threat intelligence analysis, we examine:
• The Triple X threat claim and its credibility
• Bank of Baroda's official response
• The categories of reportedly exposed customer data
• Potential risks for customers and financial institutions
• Detection and defensive recommendations for security teams

Read the full analysis:
https://gurucul.com/blog/bank-of-baroda-data-leak-analysis-of-the-triple-x-extortion-claim-and-exposed-customer-data/

Your vendors could be your biggest cybersecurity blind spot. Every third party with access to your business expands your attack surface and creates new opportunities for attackers.

As organizations rely on an increasingly connected ecosystem of suppliers, contractors, partners, and SaaS providers, managing third party risk has become a critical part of cybersecurity. A single compromised vendor can lead to data breaches, operational disruption, or supply chain attacks that impact the entire organization.

Many security teams still depend on periodic vendor assessments and compliance checks. While valuable, these methods only capture risk at a single point in time. Today's threat landscape demands continuous visibility into third party activity so emerging risks can be identified before they become incidents.

Modern third party risk management is about understanding context. By combining identity, behavior, and risk analytics, security teams can detect unusual activity, prioritize high risk relationships, and respond faster to potential threats across the extended enterprise.

In this blog, you'll learn:
✔ Why third party relationships have become a major cybersecurity challenge
✔ How vendor blind spots increase organizational risk
✔ Why continuous visibility is essential for effective risk management
✔ Best practices for strengthening your third party security strategy

📖 Read the full blog:
https://gurucul.com/blog/third-party-blind-spots-why-your-vendors-could-be-your-biggest-cyber-risk/

We’re excited to announce that the Gurucul–Cyntros Technology Alliance is now live.

Zero-day threats do not arrive with a known signature. They reveal themselves through behavior: unusual east-west traffic, lateral movement, or unexpected command-and-control activity.

The integration combines Gurucul’s AI-driven security analytics with Cyntros’ Adaptive Machine Learning-powered Network Detection and Response (NDR).

Together, they help security teams:
• Detect novel and zero-day threats beyond traditional signatures
• Identify lateral movement and anomalous network activity in real time
• Enrich Gurucul investigations with Cyntros network alerts
• Correlate network activity with endpoint, identity, and log telemetry
• Reduce false positives and extend automated AI SOC workflows
• Extend AI SOC operations with advanced network detections and automated workflows

See how Gurucul and Cyntros provide the network context security teams need to detect threats sooner and investigate them faster:
https://ow.ly/TJVO50Zt5tt

Every breach starts with bad behavior.

Not malware.
Not signatures.
Behavior.

A service account moving laterally.
An admin pulling data they never touched before.
An AI agent going off script.

Most security tools look for known threats. We look for bad behavior.
That's what we're bringing to .

Interested in how behavior-first security stops threats before they become breaches? Book a meeting or live demo with the Gurucul team at booth #4912 at the show.

Context driven security combines user behavior, identity, device activity, data access, and business context to identify high risk insider activity with greater accuracy. By enriching alerts with contextual intelligence, security teams can reduce false positives, improve investigation quality, and respond to threats before they escalate.

As organizations adopt AI for security operations, contextual analysis is becoming a critical capability for detecting insider threats, accelerating investigations, and improving SOC efficiency without increasing operational complexity.

Learn how AI and contextual intelligence are transforming insider threat detection in this on demand webinar.

Watch now: https://gurucul.com/resource/context/

Artificial intelligence is changing how Security Operations Centers handle alerts.

Modern SOCs face alert overload, limited analyst capacity, and increasingly sophisticated attacks. Manual triage often delays investigations, increases alert fatigue, and makes it harder to identify genuine threats.

AI powered SOC operations help prioritize alerts by analyzing risk, correlating security events, enriching alerts with contextual intelligence, and recommending next actions. This enables analysts to focus on high priority incidents while improving detection and response efficiency.

AI assisted alert triage is becoming a key capability for modern security operations because it reduces repetitive tasks, accelerates investigations, and improves operational consistency without replacing human analysts.

Learn how AI powered alert triage can help security teams improve SOC efficiency and respond to threats faster.

Download the solution brief: https://gurucul.com/resource/ai-soc-triage-at-the-alert-level/

Identity has become the new security perimeter.

As organizations move to cloud and hybrid environments, attackers increasingly target identities instead of networks. Compromised credentials, privilege abuse, session hijacking, and lateral movement have become common techniques because identities often provide direct access to critical systems and data.

Identity Threat Detection and Response (ITDR) strengthens identity security through continuous monitoring, behavioral analytics, risk based detection, and rapid response to suspicious identity activity. It complements Identity and Access Management, Multi Factor Authentication, Endpoint Detection and Response, and SIEM by detecting threats that traditional identity controls may miss.

Understanding ITDR is becoming essential for modern security operations and Zero Trust strategies.

Learn how ITDR works, why identity is a primary attack surface, and the best practices for protecting hybrid environments.

Read the guide: https://gurucul.com/blog/ultimate-guide-to-identity-threat-detection-and-response-itdr/

CVE-2026-45659 is now actively exploited. Is your Microsoft SharePoint environment protected?

Microsoft addressed CVE-2026-45659 in its May 2026 security updates with a CVSS score of 8.8. Initially assessed as "Less Likely" to be exploited, the risk changed significantly after CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild.

Key highlights:
• Authenticated Remote Code Ex*****on (RCE) vulnerability affecting on-premises Microsoft SharePoint Server
• Exploitable by users with Site Member permissions
• Potential for arbitrary code ex*****on, persistence, and further compromise
• Organizations should prioritize patching and perform retrospective threat hunting to identify potential indicators of compromise

Our latest analysis covers:
• Vulnerability overview and affected versions
• Timeline from Patch Tuesday to active exploitation
• Detection and threat hunting recommendations
• Mitigation and defensive best practices
• Why exploitability assessments can change rapidly after disclosure

Read the full analysis to understand the risks, strengthen your SharePoint defenses, and prioritize remediation.

https://gurucul.com/blog/cve-2026-45659-authenticated-sharepoint-remote-code-ex*****on-vulnerability-moves-from-patch-tuesday-to-active-exploitation/