Anyone who has used the Internet in recent years is probably used to encountering telltale signs of LLM prompting that lazy users sometimes forget to remove from their AI-generated pabulum. But a Canadian legislator took that idea to an embarrassing new level this week, reading an apparent LLM prompt instruction into the record during a floor speech.
Bill Oliver, a Progressive Conservative Party member of the legislative assembly of New Brunswick, noted in a speech last month that "One of the dangers associated with creating advocacy offices is that citizens often develop expectations that exceed the powers actually granted to those offices." He then went on to say out loud that "here’s a more natural, flowing version of that section that reads like a legislative speech rather than a series of short points," a line with all the hallmarks of an LLM presenting an alternative style option in response to a prompt.
The odd reading went more or less unnoticed at the time, but video of the remarks started spreading around social media networks like Reddit and Threads earlier this week. In Canada, the snafu is now getting mainstream attention from the likes of the Canadian Broadcasting Corporation and The Toronto Star, the latter of which called it a sign of "a growing divide in our society: between the elites, who are only too happy to delegate their duties to the Borg; and the masses, who find this objectionable."
Roku is raising the prices for its streaming sticks and boxes by up to 60 percent.
Roku has updated its website with the new prices. Currently, it is still selling its streaming players at their old MSRPs but lists those prices as sale prices. The new prices are:
Roku Streaming Stick: $40 (formerly $30)
Roku Streaming Stick Plus: $60 (formerly $40)
Roku Streaming Stick 4K: $80 (formerly $50)
Roku Ultra: $150 (formerly $100)
Roku Streambar SE: $150 (formerly $100)
Roku is even upping the price for a bundle that includes a Streaming Stick Plus and a one-month subscription to Fox One. As recently as July 20, Roku listed the bundle at $60 with a sale price of $25, according to the Internet Archive’s Wayback Machine. Now, the bundle carries an $80 MSRP and $45 sale price.
A security researcher writing under the name tokay0 disclosed a flaw that could allow an attacker to access and control more than 600,000 deployed Shark model robot vacuums.
Preparations for Next Moonwalk Simulations Underway (and Underwater)
An artist’s rendering of NASA’s CAPSTONE 02 spacecraft in lunar orbit. The mission features two identical small spacecraft that will further mature technologies to support Artemis, Moon Base, and deep space exploration.
Terran Orbital
NASA is working with industry to advance the next phase of cislunar infrastructure for the agency’s Artemis program and Moon Base, including orbital assets and demonstrations. Under a contract awarded to Advanced Space, the agency’s CAPSTONE 02 mission will demonstrate rendezvous and proximity operations, autonomous navigation, and cislunar communication capabilities while continuing to characterize the radiation environment at the Moon.
The CAPSTONE 02 mission, targeted for launch in 2027, will use two small spacecraft in lunar orbit to facilitate these demonstrations to support future NASA lunar and deep space missions.
NASA’s original CAPSTONE demonstration, short for Cislunar Autonomous Positioning System Technology Operations and Navigation Experiment, became the first U.S. commercial mission to the Moon and the first spacecraft to operate in a near rectilinear halo orbit around the Moon. This is a nearly stable orbit, thanks to the interactive pull of gravity from both the Earth and the Moon.
The mission successfully validated communications, networking, and autonomous navigation capabilities while gathering operational experience in cislunar space. The second CAPSTONE mission expands upon these accomplishments by transitioning from orbit validation to demonstrations that will inform future lunar exploration and infrastructure development.
Achieving our most ambitious space exploration goals requires iterative, risk-tolerant demonstrations in partnership with industry. Technology development through flight testing is how we convert hard problems into the lasting capabilities needed for a permanent presence at the Moon.
Christopher Baker
Lead of the In‑Space Infrastructure portfolio within the Research and Technology Mission Directorate at NASA Headquarters in Washington, DC.
NASA’s CAPSTONE 02 mission will demonstrate advanced relative navigation technologies for rendezvous and proximity operations in cislunar space. These techniques are more sophisticated than those used in low Earth orbit and are designed to support NASA astronauts as they dock with Moon landers in cislunar orbit, enabling safe crew transfers to and from the lunar surface.
The demonstration will fly two identical spacecraft of approximately 400 kilograms (882 pounds) from Terran Orbital Systems, Inc. Mission operators will conduct a series of rendezvous and proximity operations and loitering – or formation flying – techniques in lunar orbit with each spacecraft to better understand the trajectories of the spacecraft under the simultaneous influence of Earth and Moon gravities, otherwise known as three-body orbits.
The CAPSTONE 02 mission will use ground tracking measurements, optical sensors, and celestial bodies to help one spacecraft locate and rendezvous with another. The mission will apply navigation strategies similar to those planned for Orion’s approach to a lunar lander in deep space, helping NASA build confidence in these techniques for future exploration.
Each CAPSTONE 02 spacecraft will have the ability to switch between ‘chaser’ and ‘target’ roles, testing a broad range of operational scenarios under a variety of environmental conditions in cislunar space. Transporting crew to the lunar surface from cislunar orbit depends on knowing how well navigation systems will perform during these operations. Since these conditions can’t be fully recreated on Earth, they must be tested in space.
The CAPSTONE 02 mission also will serve as an operational testbed, enabling testing of three NASA-developed navigation software suites. Each software application will collect data during CAPSTONE 02’s low energy transfer trajectory, which will take it from the Earth to beyond the Moon before settling into a lunar orbit. The spacecraft will carry an optical imaging payload from Lawrence Livermore National Laboratory to support the navigation demonstration as well as capture imagery of the Moon. In addition, the mission will further mature the Cislunar Autonomous Positioning System navigation software that was first demonstrated on CAPSTONE as a method of determining spacecraft position relative to other spacecraft without relying on Earth-based tracking.
The suite of technologies on CAPSTONE 02 are designed to automate routine navigation tasks, reduce reliance on traditional space-to-ground data, and enable new mission concepts that may be derived from increased inter-satellite coordination. Additionally, the CAPSTONE 02 spacecraft are designed for cost-effective, rapid deployment, demonstrating a scalable and repeatable mission model.
“This mission represents an important step in the maturation of cislunar capabilities,” said Sean Fuller, Moon Base CAPSTONE manager. “By expanding on the lessons learned from CAPSTONE to demonstrate increasingly sophisticated operational concepts, CAPSTONE 02 lays the foundation for lunar infrastructure and commercial services that support Artemis, Moon Base, and future missions to deep space.”
The CAPSTONE 02 mission is funded by NASA’s Human Spaceflight Mission Directorate with support from the Research and Technology Mission Directorate. The mission is managed by Small Spacecraft & Distributed Systems, based at NASA’s Ames Research Center in California’s Silicon Valley, within the Research and Technology Mission Directorate. NASA used a Small Business Innovation Research Phase III contract to fund the mission.
To learn more about NASA’s CAPSTONE mission, visit:
Robinhood Chain crossed $311M in TVL in under three weeks. Growth like that is exactly when security gets skipped.
A rollup carrying tokenized stocks, stablecoins, and open lending markets is not just another L2 to review. The token itself is the giveaway: a Stock Token can have flawless code and still be wrong if the price feed lags, the issuer’s reserve does not match onchain supply, or the legal agreement behind the token does not say what the marketing says it does. Our RWA Handbook breaks this wider surface into five categories: asset-token mismatch, mint and burn exploits, privilege and admin risk, oracle failures, and custody and legal risk. Robinhood Chain touches all five within its first month live.
Some of the risk is just standard Arbitrum Orbit territory. Sequencer centralization, since a single sequencer orders every transaction. A seven-day fraud-proof withdrawal delay. Address aliasing on L1-to-L2 calls. Data availability gaps if blob posting is delayed. Upgrade keys controlling the rollup contract. None of this is unique to Robinhood, and all of it still applies.
Other risk is specific to this chain. Stock Tokens use ERC-8056, scaling value through a uiMultiplier() function instead of rebasing balances, so any protocol that reapplies the Chainlink feed’s built-in multiplier will double count it. An oraclePaused flag signals an unreliable price around dividends and splits, but it is advisory, not enforced onchain. A single Authorised Participant controls the entire mint and redeem pathway for every tokenized stock, sitting outside the smart contract layer entirely.
Then there is agentic trading, live now for equities and options through Robinhood’s brokerage stack, not the chain itself. Robinhood CEO Vlad Tenev has said every capability a human can do will be available to an AI agent. Crypto support is coming next, and that is when this risk surface starts sharing a trust boundary with Robinhood Chain: prompt injection through the research tools an agent reads, session and credential compromise through the MCP connection, autonomous mode removing human review by default, and correlated trading behavior across thousands of agents running similar strategies at once.
None of this makes the chain unsafe today. It makes Robinhood Chain a rollup already carrying real securities and real stablecoin liquidity, with a closely adjacent AI agent risk surface about to merge with it, exactly the kind of shift that rewards independent review before it happens.
Somewhere right now, on a livestream, someone is tearing open a foil package while hundreds of people watch. Trading cards have become a spectator sport. The card market is at all-time highs, cardboard repriced by the hour, rare cards selling for eight figures, and a general sense of frenzy. But watch enough of it and something strange becomes clear. Nobody is looking at the cards. The audience isn’t consuming images, it’s consuming anticipation.
The card boom has also surfaced hard questions, and the hardest ones surround grading. The past year saw the hobby’s dominant grading house facing scrutiny over grades that shifted after cards moved through its own buyback program, and collectors began asking, who grades the grader. When a single subjective number separates a card from ten times its value, and the arbiter of that number also holds a position in the asset, the hobby has a verification problem. These are, in the language of bitcoiners, trusted-third-party problems.
The two worlds keep arriving at the same three questions: what’s real, what’s rare, and what holds value. A graded slab and a confirmed transaction on the timechain are answers to the same anxiety. Collectors demanding transparent grading and provenance that can’t be quietly revised are asking for verification over trust, whether they use those words or not. In that sense, card collectors and bitcoiners already share the same ideals.
This is why BMAG (Bitcoin Museum and Art Gallery) is making trading cards a serious part of its program. Seven years as the cultural wing of the Bitcoin Conference, more than 130 BTC ($8+ million) in art and collectibles sales, the first Magic: The Gathering tournament at a Bitcoin Conference, staged in Las Vegas with Kraken and on-site TAG grading, and the conviction that cards are asking the same questions bitcoin already answered.
The fullest expression of that focus arrives this August. At Bitcoin Asia 2026, August 27-28 at the Hong Kong Convention and Exhibition Centre, BMAG will debut a full Trading Card Expo on the conference floor. The Expo is anchored by a marketplace of established vendors from across Hong Kong and Southeast Asia, alongside live activations, grading and authentication, card auctions, and a curated gallery presentation surrounding it all. Cards and collectibles will be available for purchase, and attendees are encouraged to bring their own cards for grading or resale to the 40+ card vendors. Hong Kong is one of the most active card markets in the world and a Bitcoin conference is the natural room for it.
But a marketplace alone isn’t the point. The trading card has an art pedigree longer than most people realize. Jefferson Burdick, the father of American card collecting, spent his final years transferring thousands of cards into albums at the Metropolitan Museum of Art, where his collection remains today. Art Spiegelman worked at Topps inventing series like Garbage Pail Kids before his mainstream graphic novel successes. And the critic Brian Droitcour recently put his finger on why the format matters right now: a Magic card is an image that does something, rarity and function entwined, while NFTs inherited that logic and captured only the rarity. Droitcour argues that NFTs dissolved the old hierarchy between the artwork and the collectible, and that the most interesting artists working today make objects that are both at once.
A generation of artists has taken that invitation literally. Over the past few years, a loose scene of mostly pseudonymous artists, formed across crypto subcultures, Twitter timelines, and private group chats, has been quietly staging one of the more genuine artistic rebellions of the decade. Where the establishment crypto-art world courted galleries with polished generative work, these artists went the other direction, making images dense with meme references, anime, veiled art history, and internet debris, layered so deep that critics had to invent new words for them. They call the style schizocollage. In Spike Art Magazine, Dean Kissick placed the work in the lineage of deliberately “bad painting,” a tradition Marcia Tucker gave institutional credentials when she inaugurated the New Museum with an exhibition of that name in 1978. And increasingly, the scene’s work has been heading not toward the gallery wall but toward cardboard: the pack, the pull, the sleeve, and the slab treated not as merchandising afterthoughts but as the medium itself.
BMAG has spent years working in a room the traditional art world ignored, the art gallery inside a Bitcoin conference. When the painter Nardo showed at Bitcoin MENA in 2024, our conversation kept circling memes as units of cultural transmission and the internet’s layered debris as legitimate subject matter for painting. A year later his Citadel, a seven-foot oil painting built from a 4chan meme, debuted at the Bitcoin Conference in Las Vegas: a monument raised to an internet shitpost. The card movement runs on the same current at a different scale, small enough to fit in a penny sleeve. It’s a conversation we’ve continued in these pages all year, with founders like Alladan Flinn of Based Trading Cards, who describes cards as physical timestamps of the Bitcoin movement. We’ll have much more to say about the artists of this scene, and what they’re bringing to Hong Kong, in the weeks ahead.
The Card Expo debuts at Bitcoin Asia 2026, August 27-28 at the Hong Kong Convention and Exhibition Centre. Vendors of cards, collectibles, and related goods can apply for a table here. Tables are limited.
Follow BMAG on X at @BMAG_HQ for new partnership announcements, auctions, and first looks at the artists coming to Hong Kong.
Welcome to Edition 9.04 of the Rocket Report! We've had to wait an extra week for SpaceX to get its 13th Starship test flight off the ground. A last-second abort on July 16 led engineers to roll the booster back to its hangar in South Texas to swap out engines. Starship is now back on the launch pad. Liftoff is set for Friday evening. A flawless launch and reentry will put SpaceX on the cusp of an orbital flight later this year. Ars will have a comprehensive recap story after the completion of the test flight.
As always, we welcome reader submissions. If you don't want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets, as well as a quick look ahead at the next three launches on the calendar.
India's first private rocket reaches orbit. Indian space officials celebrated the debut flight of Skyroot Aerospace’s Vikram-1 rocket, India’s first fully commercial satellite launcher, as a “grand success” Saturday after an on-target climb into a 280-mile-high orbit following liftoff from an island spaceport in the Bay of Bengal, Ars reports. The Vikram-1 lifted off from India’s primary spaceport on Sriharikota Island around midday local time. The launch was delayed more than a half-hour to resolve a last-minute technical problem. The countdown resumed, culminating in the command to ignite Vikram-1’s solid-fueled first stage booster to propel the rocket off the launch pad.
An excavator and bulldozer operating autonomously using AIM Intelligent Machines’ AI platform work at the company’s proving grounds near Monroe, Wash. (AIM Photo)
In a headquarters and lab space formerly occupied by SpaceX in Redmond, Wash., AIM Intelligent Machines (AIM) is focused on solving big problems on Earth. But the startup’s CEO envisions a day when autonomous bulldozers and excavators will dig, haul, and grade on the moon or Mars, and take AIM’s “terraforming mission” off planet.
For now, AIM’s 25,000-square-foot facility in a nondescript business park is a long way from Mars. Inside the sprawling space, there are glimpses of what the rapidly growing company is working on, including the apparatuses that attach to existing machines to make them self-driving.
Around the office, desk cubicles are decorated with tiny yellow excavator buckets, mirroring photos on the walls of heavy equipment operating on job sites worldwide.
AIM founder and CEO Adam Sadilek. (AIM Photo)
The toy excavators are a nod to a massive global market that AIM founder and CEO Adam Sadilek wants to continue to disrupt with modern technology.
Autonomous passenger vehicles have captured the public’s attention for decades, but construction, mining and hauling equipment attracts little fanfare, even as legacy companies including Komatsu and Caterpillar embrace new technology.
AIM’s goal is not to build new machinery, but retrofit existing earthmoving fleets with a physical AI platform — using advanced sensors and edge compute to let heavy iron operate entirely on its own.
Founded in 2021, the startup grew out of Sadilek’s background at Google where he spent nine years working on projects involving AI and autonomous vehicle systems.
Whether building anti-flood structures or wildfire breaks, managing nuclear waste, mining critical materials or clearing land for agriculture or the military, Sadilek views AIM’s work as immediate terraforming on Earth that is necessary to drive down costs for housing and commodities. But the long-term vision remains interplanetary.
“When humanity goes to Mars, the real question is not so much around what the rocket looks like as a vehicle to get us there, but what is going to happen after the rocket lands,” Sadilek said. “You cannot have human operators run there. That’s why this is a very long mission that we are on.”
Building autonomy for heavy equipment presents a paradox self-driving cars never have to face: the ground itself is constantly changing. While a Tesla or Waymo relies on pre-mapped roads and predictable lanes, a bulldozer or excavator’s entire job is to reshape its environment. AIM’s physical AI platform has to continuously build real-time 3D maps using onboard 360-degree LiDAR and edge compute, making split-second decisions without relying on persistent GPS or cloud connectivity on remote job sites.
Furthermore, taking human operators out of cab seats addresses one of the most perilous aspects of heavy industry. By creating “zero-entry” sites where machines operate autonomously, AIM’s platform effectively removes workers from harm’s way — transitioning traditional equipment operators into remote site supervisors who oversee entire fleets from a safe distance.
Beyond early deployments in mining and site preparation for data centers, AIM landed a $4.9 million U.S. Air Force contract earlier this year to deploy autonomous machines for airfield repair and base construction in remote or high-risk zones. The military work builds on the company’s growing momentum following a $50 million funding round backed by Khosla Ventures, General Catalyst, and Human Capital.
AIM has risen to No. 110 on the GeekWire 200 ranking on top Pacific Northwest startups.
To support its growth, AIM has rapidly expanded its headcount, doubling in size to about 80 employees in the last few months. Sadilek is attracted to the Seattle area’s intersection of hardware expertise from companies like Boeing and Amazon alongside top-tier software and AI talent.
But while AIM has managed to hire a couple former SpaceX engineers to build out its team, it isn’t the only startup mining that rocket-engineering pedigree. TerraFirma, an Austin-based company founded by two more SpaceX engineers, raised $115 million earlier this month in the burgeoning race to semi-automate physical construction.
For Sadilek, anchoring his team in Redmond rather than Silicon Valley was a deliberate decision to stay rooted in physical engineering. Having spent years in the Bay Area during his time at Google, Sadilek wanted to avoid the tech industry’s “echo chamber.”
“I wanted to be somewhat shielded from the Kool-Aid in Silicon Valley,” he said. “We wanted to build something that’s real and gets in the black really quickly… To do that, you need to do it in an environment that is more anchored in reality.”
That philosophy extends directly into their field testing. AIM’s regional proving grounds in the mountains near Monroe, Wash., expose the autonomous equipment to heavy snow and inclement weather early in development so the physical AI is built for harsh, real-world conditions from day one.
The poster that hangs in AIM’s lunchroom: “Building the plane while flying it” is a popular startup cliche, but it was close to real life during an April 1949 endurance flight in which the Sunkist Lady took on supplies while in the air. (Image via Orange County Public Libraries)
Amid the hard hats, safety vests and construction-related decor in AIM’s headquarters space, one piece of art offers a fun take on where AIM has been and where it’s headed.
The 1949 photograph, titled “Refueling the Sunkist Lady,” shows a Jeep driving beneath a low-flying plane and transferring supplies to aid the crew during an endurance flight.
Sadilek likes it as a reminder of getting started, and what it feels like to build a company from scratch, literally working on the airplane while it’s already rolling down the runway.
“The first years of AIM were exactly like that,” he said. “I think every tech startup is like that in the early days. The problem is that some of them never finish building it before the runway ends.”
Meta avoided a closely watched social media addiction trial after the plaintiff dropped the remaining claim, leaving broader questions over platform design unresolved.
Meta avoided a closely watched social media addiction trial after the plaintiff dropped the remaining claim, leaving broader questions over platform design unresolved.
Ethereum price has retreated to $1,880 after failing to clear $2,000, as profit-taking, rising derivatives leverage and a sharp U.S. technology-stock sell-off weakened market sentiment. According to data from crypto.news, Ethereum (ETH) price traded near $1,882 at press time, down…
SpaceX, Blue Origin, and others want enormous orbital data center constellations, prompting warnings over atmospheric pollution, debris, and an astronomy problem satellites are already making worse.
For thirty years, we have measured security operations by the tools we buy. The next decade will measure us by the outcomes we deliver. That shift is already here, and it is being driven by something quietly radical: a repository of AI “skills” that turns the deep expertise of a principal analyst or engineer into a capability any team member can invoke on demand.
I want to talk about what that actually changes for the business, not the bits and bytes underneath it.
The problem every CISO already knows by heart
You are not short on data. You are drowning in it. Endpoint telemetry, identity logs, firewall traffic, cloud control planes, email security, SaaS audit trails. Each one speaks a different language. Each one demands a specialist who knows where the bodies are buried. The talent who can fluently read all of them at once is rare, expensive, and almost certainly already burned out.
So the work stacks up. Alerts wait. Investigations get triaged by whoever is awake. The third repeat of an attack pattern goes unnoticed. The analyst who caught the first two left for a competitor. Your security posture quietly becomes a function of who happens to be on shift.
This is the real cost center in modern security operations: expert human attention, not licenses or infrastructure. There is never enough of it.
What changes when expertise becomes a skill
The ai-siem repo, located on the Sentinel One GitHub community (https://github.com/Sentinel-One/ai-siem/tree/main/plugins/s1-secops-skills), attacks that bottleneck directly. Instead of asking a human to remember how to query log sources, pivot through threat intelligence, correlate findings, and write it all up, each of those steps becomes a skill. Captured once. Available to everyone, every shift, every time.
Disclaimer: This sample script/prompt is community-contributed, open-source content provided “AS IS,” without warranty of any kind. SentinelOne does not certify or endorse it, is not responsible for its accuracy or outputs, and is not liable for any outcomes arising from its use. Test and validate in a non-production environment before use.
The senior analyst’s playbook stops living in one person’s head. It becomes a durable asset owned by the whole organization. That single change cascades into outcomes leadership actually cares about.
The data lake is the foundation nobody’s talking about
Here is the part that makes the rest of it work. It is the most underrated shift in security right now. Skills are useless if the data lives in a dozen disconnected silos. Each has its own query language, retention tier, and price per gigabyte. The reason this whole model becomes possible is the security data lake. A single place where endpoint, identity, network, cloud, email, and your own application logs land together in one queryable substrate, at a cost that doesn’t punish you for keeping data.
This is where SentinelOne’s Singularity Data Lake stops being infrastructure and starts being the differentiator. It was built for streaming AI from day one, not retrofitted onto it. That architecture is what makes an AI analyst viable. Data becomes searchable the moment it arrives. No indexing delay to wait through. Everything stays hot and searchable. All of it. There’s no cold tier to thaw, and no log you quietly dropped because retention got expensive. It scales to petabytes where legacy SIEMs buckle at terabytes. And it does this at more than ten times the query performance, for less than half the cost of the per-gigabyte SIEM model it replaces.
Translate that into outcomes, and the picture is stark. Ingestion, detection, and query that used to take minutes to hours on a legacy SIEM now happen in seconds. More than 2,000 detections run in the stream itself. Threats surface as the data lands, not minutes after it’s stored. That speed is not a nice-to-have. An AI agent is only as fast as the data underneath it. Give it a lake that answers in under a second, and it reasons across your entire estate before you’d have opened one console tab.
That is what breaks the twenty-year SIEM economics. For twenty years, the industry’s answer to “where do we put all the security data” was a SIEM. One that charged so much per gigabyte that teams were forced to drop the very logs they later wished they’d kept. The data lake inverts that math. Keep everything. Query everything. Correlate everything. Let the ingest bill stop dictating your detection strategy. The skills are the brain. The data lake is the nervous system, letting the brain feel the whole body at once, instantly. You cannot have the outcomes below without it.
This is Autonomous Cybersecurity (AI-Native Protection Across the Enterprise) in practice. Autonomous Security Intelligence, ASI, is the intelligence fabric that runs on top of that data. It is not a bolt-on skill pack. It is what turns a queryable lake into an analyst that never sleeps.
Outcome 1: Investigations that took a shift now take minutes
The gathering is the slowest part of any investigation, not the decision: pulling the alert, finding the affected asset, enriching every indicator against external intelligence, sweeping the rest of the fleet for the same fingerprint, and assembling the timeline. That is hours of skilled work that have to happen before anyone can even say “true positive” with confidence.
When those steps run as orchestrated skills, the gathering collapses into minutes. Your analysts spend their judgment on the verdict and the response, which is the part only a human should own. Mean time to detect and mean time to respond stop being aspirational metrics on a slide. They become numbers you can defend to the board.
Outcome 2: A first-year analyst operating at a principal level
This is the one that genuinely reshapes the org chart. When the hard-won method of your best investigator becomes a skill, a junior analyst inherits it directly: the answer, arrived at the right way, with evidence cited, confidence calibrated, and assumptions flagged.
The skills gap that has defined this industry for a decade narrows dramatically. You stop competing for the handful of unicorns who can do everything, because everything is now a shared capability. Tier-one talent does tier-three work. New hires become productive in days, not quarters. And the people you already have stop drowning. That’s how you keep them.
Here is what convinced me that this is real and not a demo. It was not a SOC analyst who proved it first. It was an engineer. Reviewing application logs, they surfaced a genuine fraud case. A true positive lived in business telemetry. No traditional security tool was even watching. Sit with that for a second. People who do not carry a security title, looking at data that never reaches the SIEM, caught actual fraud. That is what happens when investigative expertise stops being gated behind a job description. The capability travels to wherever the data and the curiosity are. Threats that used to hide in the gaps between teams suddenly have nowhere to live.
More impact per analyst and greater control with less fatigue.
Outcome 3: No blind spots, because nothing gets correlated in isolation
Attackers do not respect your tool boundaries. They land in email, execute on the endpoint, move through identity, and leave through the network. A threat that is invisible in one source is often obvious the moment you line it up against three others. The trouble is that lining them up has always required a specialist for each layer. All working in concert, under time pressure, at 3 am.
Cross-source correlation built into the workflow doesn’t depend on who’s in the room. The full attack story assembles itself. You see the chain, not the fragments. The single most dangerous phrase in security operations, “we had the data, we just never connected it,” starts to disappear.
Outcome 4: Every alert arrives with context already attached
A medium-severity alert on a domain controller matters more than a critical one on a throwaway sandbox. Every experienced analyst knows this. Yet most alerts land in the queue as bare indicators with no business context. Someone has to hunt down what the asset is, who owns it, and whether it matters. That manual lookup happens thousands of times a week. It’s where prioritization quietly goes wrong.
When asset enrichment runs autonomously, every log and every alert already carries the device and user context that determines its importance: what the machine is, how critical it is, and whose account is involved. The queue effectively sorts itself by business impact. Analysts stop chasing noise in disposable systems and spend their time where the real risk lies. False-positive fatigue drops, and the genuinely dangerous signal stops getting buried under the trivial. Prioritization by business impact stops being an aspiration and becomes the automatic default.
Outcome 5: Proactive defense, finally, at machine speed
Known-bad signatures catch yesterday’s threats. The adversaries that actually hurt you, the patient ones and the insiders, only ever show up as deviations from normal. A login at an impossible hour. A workstation reaching a destination it’s never touched. A service account suddenly behaving like a human.
Hunting for that kind of anomaly across the entire estate, continuously, has always been a luxury. Reserved for the most mature and best-funded teams. Make it a repeatable skill and proactive hunting stops being a quarterly project you never quite get to. It becomes the default mode of the SOC. You move from reacting to alerts to anticipating the attacker’s next move. That is the whole point of the discipline. Most teams never have the capacity to actually do it.
Outcome 6: A new threat in the headlines becomes a detection the same morning
When a new campaign breaks, the clock starts immediately. The window between “this threat is now public” and “we are protected against it” is pure exposure. Historically, that window has been measured in days or weeks. Someone has to read the intelligence, translate it into detection logic, test it, and push it live. That someone is usually already underwater.
Make detection engineering a skill, and that window collapses to a morning. The moment an emerging threat surfaces, its behavior becomes a live detection rule: validated and deployed across the estate before the first coffee gets cold. Your defenses move at the speed of the threat landscape instead of at the speed of your backlog. Just as importantly, the detection logic your team writes today gets captured and reused. Coverage doesn’t just grow. It compounds.
Outcome 7: New data sources onboarded in minutes, not quarters
Onboarding a new data source has traditionally been a small project: parse the logs, normalize the fields, build the dashboards, write the detections, and wire up the response. Weeks of specialist time have to pass before that source earns its keep. That’s exactly why the backlog of “sources we really should be ingesting” never shrinks.
That math is now broken in your favor. When those steps are packaged as skills, a new feed goes from raw and unreadable to fully operational in minutes: normalized, with detections firing and a dashboard live. Read that again, because it rewrites your roadmap. Every integration you’ve been deferring for budget or bandwidth reasons just got cheap. Cheap enough to do the same day someone asks for it. Coverage stops being a function of how many quarters you can fund. It becomes a function of how fast you can decide.
That is the compounding version of Maximize Efficiency and Effectiveness of Security Operations: coverage that gets cheaper and faster to extend every time you use it.
The economics that should end the conversation
Now brace for the part that makes the CFO lean in. Everyone assumes the AI is the expensive bit. It is the opposite. Bring-your-own-AI on top of the data lake costs peanuts relative to what it replaces and the work it does. The heavy historical spending on security operations was never on intelligence. It was on the ingestion licensing of a legacy SIEM, and the salaries of specialists doing by hand what a skill now does in seconds.
Sit the two columns next to each other. On one side: per-gigabyte SIEM pricing that grows with your business, whether or not it makes you safer. Plus the fully loaded cost of analysts spending their nights on manual gathering. On the other: a data lake built for scale, and an AI layer whose run cost rounds to a rounding error against either line item. The capability goes up and to the right while the cost line stays flat. That’s a different business model for security. It’s a rare case where the cheaper option is also the more capable one.
This is Enable Business Growth and Innovation Safely in dollar terms: the budget fight between “more coverage” and “more efficient spend” disappears, because the same architecture delivers both.
The deeper shift: the SOC stops being a cost center and starts compounding
Here is the part that should excite anyone running a security budget. Every investigation a human does is an effort spent once and largely lost. Every investigation captured as a skill is an effort spent once and reused forever. Your operation stops being a treadmill and starts being an asset that compounds. The work your team does today makes the work tomorrow faster, cheaper, and more consistent.
AI answering faster is the easy headline. The real shift: institutional security expertise stops walking out the door and starts accumulating on the balance sheet.
What I would tell a peer
We have spent a generation buying tools and hoping the outcomes follow. The teams that win the next decade will flip the order. Define the outcomes first. Then make the expertise to achieve them a capability everyone can summon, day or night, junior or senior, first alert or thousandth.
The technology to do this exists now. Our purpose is simple: to give the advantage to those who secure our future. That advantage only counts if it reaches every analyst, not just the ones already fluent in every log source. The organizations that adopt it won’t just be faster. They’ll run a fundamentally different kind of security function: one where the best analyst in the building is available to everyone, all the time, and gets sharper with every case it touches.
The bottleneck was never the data. It was access to expertise. That bottleneck just broke.
If you run a SOC, lead security for your organization, or work the queue every day: how much of your team’s best thinking is locked inside one or two people right now? That is the question worth sitting with this week.
Curious what this looks like in practice for your environment? Come talk it through in our Reddit community, r/SentinelOneXDR. Practitioners there trade real detection logic, ask the SentinelOne team direct questions, and compare notes on what’s actually working in their SOCs.
Disclaimer: The sample scripts, code, AI prompts, and other tools referenced or included in this publication (“Community Content”) are provided for informational and educational purposes only. Community Content is contributed on an open-source basis and is made available “AS IS” and “AS AVAILABLE,” without warranties of any kind, whether express, implied, or statutory, including, without limitation, any warranties of accuracy, completeness, reliability, merchantability, fitness for a particular purpose, or non-infringement.
SentinelOne does not certify, endorse, or guarantee any Community Content, its outputs, or its suitability for any particular use, and Community Content does not constitute part of any SentinelOne product or service offering. SentinelOne has no obligation to maintain, support, or update Community Content. AI prompts in particular may produce inaccurate, incomplete, or unexpected results depending on the model, configuration, and environment in which they are used.
Any use of Community Content is at your own risk. You are solely responsible for evaluating, testing, and validating any Community Content in a non-production environment before use, and for ensuring your use complies with applicable laws, licenses, and your organization’s policies. To the maximum extent permitted by law, SentinelOne and its affiliates will not be liable for any damages, losses, or outcomes of any kind arising out of or relating to the use of, or reliance on, Community Content. Where Community Content is hosted in or links to a third-party repository (e.g., GitHub), your use is also governed by the applicable open-source license and the terms of that platform.
In Ethereum news today, Fasanara Capital, a London-based quantitative asset manager, is holding a $67M ETH short on Hyperliquid via an on-chain wallet labeled “BobbyBigSize,” and the directional bet is almost beside the point.
What matters is that institutional-grade capital is now executing complex, multi-leg crypto derivatives strategies entirely on a decentralized venue, in full public view, in a way that would have looked implausible just two years ago.
The position is visible through Hyperliquid’s on-chain explorer at wallet address 0x7fda..17d1. On-chain analytics providers including Arkham Intelligence and Nansen have linked the wallet to Fasanara Capital.
The short sits on Hyperliquid, one of the most closely watched decentralized perpetuals exchanges in the market, a venue that has grown rapidly by offering execution quality and liquidity depth that professional traders previously expected only from centralized exchanges.
The instinctive read- large ETH short, therefore bearish signal does not survive contact with how quantitative funds actually operate. A short of this size can be a directional bet, but it can equally be a hedge against spot ETH holdings, an offset against options book exposure, one leg of a basis trade, or part of a market-neutral spread.
Fasanara runs systematic, multi-strategy books where relative pricing, funding rates, liquidity, and volatility relationships matter far more than a clean up-or-down call on ETH.
Supplementary on-chain data, reported by Phemex and attributed to Arkham Intelligence, adds another layer: holds an additional ~$41M ETH short on Hyperliquid, and should be treated as supplementary attribution, but if accurate, it reinforces that this is coordinated institutional positioning across multiple regulated managers, not a lone prop desk swing.
This includes approximately $11Bn in cumulative trading volume on Hyperliquid in ETH, BTC, AVAX, HYPE, and other tokens. That is the profile of a systematic, high-frequency institutional book, not a retail trader making a leveraged directional bet.
The current ETH leverage environment and funding dynamics give that short context: in a market where funding rates and open interest are already elevated, a large institutional short of this kind can function as a structural offset rather than a conviction trade.
In adjacent Ethereum news, Hyperliquid has compressed the quality gap between on-chain derivatives and centralized exchange execution to the point where a fund managing multi-billion-dollar mandates is comfortable running nine-figure notional exposure natively on-chain.
Fast matching, deepening order book liquidity, and a familiar perpetuals interface have done what earlier DeFi derivatives platforms could not: attract serious derivatives flow rather than just yield farmers chasing incentives. The Hyperliquid trading interface features advanced charting and real-time order book data.
The structural consequence is a new kind of market signal. Centralized exchange positioning has always been inferred indirectly, through funding rates, open interest, liquidation data, and exchange-reported metrics.
Institutional DeFi trading on Hyperliquid makes wallet-level positioning directly observable. Analysts can track when Fasanara adds to or reduces its size and monitor collateral and position changes. That transparency is what DeFi trading was theoretically supposed to create, and now it is arriving at institutional scale.
The fund reportedly holds a concurrent BTC long entered around $75,950, plus shorts across TON, AVAX, and DOGE, a cross-asset relative-value book executed entirely on a decentralized perpetuals venue.
That breadth signals that Hyperliquid is functioning as primary execution infrastructure for at least one major quant manager, not a peripheral experiment running alongside the real book on Binance or OKX.
Login
