Security expert insight on the $6.3 billion cryptocurrency heist. 

“The instincts I built 25 years ago no longer apply,” says Randolph Barr, Chief Information Security Officer at Cequence Security. Six cybersecurity experts share what scares them most about the current landscape. 

Validation in AI pentesting is the process that ensures a simulated exploit or vulnerability is legitimate, reproducible, and poses a security risk to the targeted system. It’s the foundation of effective risk prioritization.   As penetration testers rely more heavily on AI tools to produce results at scale, exploit validation has become increasingly important in separating [...]

Is “autonomous” an overused word in security AI? Bobby Filar, Head of AI at Sublime Security, shares with Security magazine how the word “autonomous” is being used in the industry and how he views the term. 

By Oliver Spence, CEO, CybaVerse

According to a recent report from insurance firm Hiscox, 38 percent of UK organisations have a suffered cyber attack in the last year.

The figure is not hugely surprising. Cyber crime is widely recognised as the number one threat to business today. However, what is concerning is that the rate of attacks is surging even despite organisations increasing their spending on defences.

According to the same study, firms are spending significant money to ward off the threat of hacks, with the average UK firm spending £44,294 on resilience measures.

This raises an important question, why when organisations are boosting their investments in cyber defences are business crippling attacks continuing to surge?

The UK’s outsourced security market

UK organisations spend heavily on outsourced cyber security.

Government analysis recently revealed that the cyber services market, which includes MSSPs, is now worth approximately £8.4 billion annually.

The figure highlights that many organisations in the UK are outsourcing their security, ensuring it is managed by experts.

This is also not surprising.

Cyber security is a full-time, 24/7 position and most organisations don’t have the resources to manage it internally.

However, even despite this migration to managed services, it doesn’t explain why operationally impacting attacks continue to increase?

Could it highlight that traditional managed security models are often too focused on identifying threats, rather than helping organisations actually remove the weaknesses that allow threats to succeed?

Managed Detection and Response

One of the most common activities for organisations to outsource is their security operations.

Organisations will rely on experts to monitor their digital assets for malicious activity, ensuring incidents are stopped and contained before they escalate into full scale attacks.

However, one of the key issues with Managed Detection and Response is that it only focuses on containment, not remediation.

Security analysts will continually triage alerts coming into the SOC, investigating them to identify malicious activity. If malicious activity occurs, they will then work to understand the incident, investigate it and contain it.

However, this model only contains the incident, it doesn’t remediate the cause behind it.

Take the exploitation of an unpatched vulnerability. A SOC may detect the malicious activity, isolate the affected device, remove malicious files and restore the environment to its previous state.

The incident has been contained, but has the problem actually been remediated? Not if the vulnerability remains unpatched.

The same applies if an attacker gained access because of a misconfiguration, weak Microsoft 365 control or another security gap. Restoring the environment to the state it was in before the attack simply restores the weakness too.

This is where we need to make a much clearer distinction between containment and remediation.

Containment stops the immediate threat. Remediation addresses the weakness that allowed it to happen in the first place.

Without the final step, organisations risk operating in permanent firefighting mode. The flames are extinguished, but nobody is addressing what keeps starting the fires.

Introducing MDR+R

When organisations are selecting an MDR provider, they first must understand the genuine improvements to security being offered.

Simply acting on incidents is not enough. The partner must also make tangible improvements to the overall security of the business.

One of the best ways to achieve this is by partnering with providers that don’t just respond to threats, but also take actions to remediate the root cause of incidents.

These providers don’t simply triage alerts and contain incidents, they work to understand how an attack happened and then provide support to organisations to remediate the issue at its very root.

The overall goal is to close the loop on incidents, not leave them open to be exploited again.

The three-year test

This brings us to a question every organisation outsourcing its security should ask.

If you have been working with a SOC provider for three years, are you more secure today than you were when the relationship started?

Your attack surface may have expanded. Threat activity may have increased. Attackers may have become more sophisticated. These factors obviously won’t be within your SOC provider’s control, but there should still be tangible evidence that security is improving.

Known weaknesses should be getting closed. Previously identified attack paths should be disappearing. Misconfigurations should be addressed. Vulnerabilities should be remediated. The number of exploitable gaps sitting within the environment should be reducing.

If, after three years, and significant investment, the same security gaps remain open, organisations have every right to ask what they are paying for.

Containment keeps an organisation running. Remediation makes it more secure.

Organisations must demand both.

The post Closing the loop: Why an effective SOC focuses on remediation, not just containment appeared first on IT Security Guru.

Hackers targeted the US Federal Election Commission, emphasizing that election security shouldn’t start and end with voting machines. 

Microsoft released emergency .NET patches for .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. 

New research from METR reveals that OpenAI’s internal agent monitoring systems had safeguard gaps.

Did Claude AI hack voter data? Security leaders discuss. 

PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been exploited in the wild. 

Unauthorized third-party AI agents are accessing banks in the United States, with some attempting to act independent of user instructions. 

Quest Diagnostics, a diagnostic information services provider, revealed it experienced a cyber breach.

PHP, which is used in most major operating systems, has issued fixes for two critical vulnerabilities. Security leaders discuss. 

Security magazine tackles the issue of CISO burnout alongside Chris Bevil, global cyber resilience and AI leader at Commvault. 

California students and families were recently notified of a data security incident, and security leaders are sharing their concerns. 

DeepSeek has been banned from civilian federal agencies.

Anthropic stated that it has begun to roll out “employee-like access” to a METR team. 

It Stops Now, a campaign calling for action over police suicides, was just launched. 

BAE Systems was hit with a cyberattack that halted production/distribution of bankruptcy notices. 

The financial sector was recently targeted by an AI hacking attack.