Connect with us

News

Vectra AI Unveils Hybrid Attack Detection and Response Platform Driven by Artificial Intelligence

Published

on

Vectra AI has announced the Vectra AI Platform with patented Attack Signal Intelligence to deliver the integrated signal enterprises need to make extended detection and response (XDR) a reality. With the Vectra AI Platform, enterprises can integrate Vectra AI’s public cloud, identity, SaaS, and network signal with existing endpoint detection and response (EDR) signal to arm SOC teams to keep pace with the ever-growing sophistication, speed, and scale of hybrid attacks

As enterprises shift more applications, workloads, and data to hybrid and multi-cloud environments, threat detection and response has become increasingly siloed and complex. Without an effective solution for advanced hybrid attackers, security teams face a vicious spiral of more attack surfaces, more evasive attacker methods, more alerts, and thus, more SOC analyst workload and burnout.

Recent research found that 63% of SOC analysts report that the size of their attack surface has increased in the last three years and 67% are unable to manage the number of daily alerts received. The Vectra AI Platform enables security teams to move at the speed of modern hybrid attackers to identify behaviour that other tools cannot. Harnessing the power of AI to analyze attacker behaviour and automatically triage, correlate, and prioritize security incidents, the Vectra AI Platform provides the integrated signal powering XDR.

“To us, it’s always about outcomes, not acronyms. It’s about the end goal, not some prescribed definition of how to get there,” said Jay DePaul, Chief Cybersecurity & Technology Risk Officer at Dun & Bradstreet. “Vectra AI is helping us achieve our end goals, stop advanced adversaries, modernize our security operations, and ultimately, improve our cyber resilience.”

According to Jon Oltsik, distinguished analyst and Enterprise Strategy Group (ESG) fellow, “Regardless of how XDR is defined, security professionals are interested in using XDR to help them address several threat detection and response challenges. XDR seems like an attractive option since current tools struggle to detect and investigate advanced threats, require specialized skills, and aren’t effective at correlating alerts. In summary, CISOs want XDR tools that can improve security efficacy, especially regarding advanced threat detection. Additionally, they want XDR to streamline security operations and bolster staff productivity.”

The Vectra AI Platform integrates native and third-party attack signals across hybrid cloud domains including AWS, Microsoft Azure, Google Cloud Platform, Microsoft 365, Microsoft Azure AD, networks of all types, and endpoints leveraging the customer’s Endpoint Detection and Response (EDR) tool of choice. The Vectra AI Platform integrated signal enables security teams to:

  • Cover more than 90% of MITRE ATT&CK techniques with patented and proven MITRE D3FEND countermeasures.
  • Combine AI-driven behaviour-based detection, signatures and threat intelligence for the most accurate representation of active attacks in progress.
  • Map attacker progression and lateral movement from the data centre to the cloud, cloud to the data centre and cloud to cloud.
  • Build and mature threat-hunting programs and conduct deep forensic investigations.

Vectra AI Attack Signal Intelligence harnesses patented AI to automate threat detection, triage, and prioritization across hybrid cloud domains, by:

  • Zeroing in on attacker behaviour, analyzing in many dimensions to see real attacks in a sea of different while patented Privileged Access Analytics (PAA) focuses on accounts most useful to attackers.
  • Learning customers’ unique environments to distinguish between malicious and benign events to eliminate 80% of alert noise.
  • Prioritizing entities (hosts and accounts) across domains based on urgency and importance, saving individual SOC analysts over three hours per day of alert triage.

With Vectra AI, security teams accelerate investigation and response workflows with integrated investigations sophisticated enough for experienced analysts, and simple enough for junior analysts. New capabilities include:

  • Instant Investigations arm analysts of every skill level with quick-start guides to investigate prioritized entities under attack.
  • Advanced Investigation enables forensic analysis of Azure AD, Microsoft 365, or AWS Control Plane logs directly in the platform user interface (UI).
  • AI-Assisted Investigation leverages large language models (LLMs) to provide analysts with a simple way to gather 360 degrees of context on entities under attack.

The Vectra AI Platform puts humans in control of response by offering flexible response actions both native and orchestrated leveraging over 40 ecosystem integrations to:

  • Manually or automatically lock down an account, or isolate an endpoint.
  • Trigger security orchestration and automation (SOAR) playbooks and workflows.
  • Streamline ticketing, communication, and escalation for incident response processes.

SOC teams continue to be stretched thin as the volume and variety of high-speed hybrid and multi-cloud attacks grow. With the Vectra AI Platform, enterprises can take advantage of analyst reinforcements in the form of MDR services, including:

  • Shared roles and responsibilities for monitoring, detection, investigation, hunting and response.
  • Shared analytics on attacker behaviour and emerging attacker tradecraft, tactics, techniques, and procedures.
  • Shared transparency around SLAs, metrics, and reporting.

“The current approach to threat detection and response is fundamentally broken, as more organizations shift to hybrid environments and security teams continue to face increasing cloud complexity, alert fatigue, and analyst burnout,” said Hitesh Sheth, president and CEO of Vectra AI. “As the pioneer of AI-driven threat detection and response, our best-in-class platform delivers the most accurate integrated signal across the hybrid Enterprise to make XDR a reality at speed and scale.”

Artificial Intelligence

Cequence Intros Security Layer to Protect Agentic AI Interactions

Published

on

Cequence Security has announced significant enhancements to its Unified API Protection (UAP) platform to deliver a comprehensive security solution for agentic AI development, usage, and connectivity. This enhancement empowers organizations to secure every AI agent interaction, regardless of the development framework. By implementing robust guardrails, the solution protects both enterprise-hosted AI applications and external AI APIs, preventing sensitive data exfiltration through business logic abuse and ensuring regulatory compliance.

There is no AI without APIs, and the rapid growth of agentic AI applications has amplified concerns about securing sensitive data during their interactions. These AI-driven exchanges can inadvertently expose internal systems, create significant vulnerabilities, and jeopardize valuable data assets. Recognising this critical challenge, Cequence has expanded its UAP platform, introducing an enhanced security layer to govern interactions between AI agents and backend services specifically. This new layer of security enables customers to detect and prevent AI bots such as ChatGPT from OpenAI and Perplexity from harvesting organizational data.

Internal telemetry across Global 2000 deployments shows that the overwhelming majority of AI-related bot traffic, nearly 88%, originates from large language model infrastructure, with most requests obfuscated behind generic or unidentified user agents. Less than 4% of this traffic is transparently attributed to bots like GPTBot or Gemini. Over 97% of it comes from U.S.-based IP addresses, highlighting the concentration of risk in North American enterprises. Cequence’s ability to detect and govern this traffic in real time, despite the lack of clear identifiers, reinforces the platform’s unmatched readiness for securing agentic AI in the wild.

Key enhancements to Cequence’s UAP platform include:

  • Block unauthorized AI data harvesting: Understanding that external AI often seeks to learn by broadly collecting data without obtaining permission, Cequence provides organizations with the critical capability to manage which AI, if any, can interact with their proprietary information.
  • Detect and prevent sensitive data exposure: Empowers organizations to effectively detect and prevent sensitive data exposure across all forms of agentic AI. This includes safeguarding against external AI harvesting attempts and securing data within internal AI applications. The platform’s intelligent analysis automatically differentiates between legitimate data access during normal application usage and anomalous activities signaling sensitive data exfiltration, ensuring comprehensive protection against AI-related data loss.
  • Discover and manage shadow AI: Automatically discovers and classifies APIs from agentic AI tools like Microsoft Copilot and Salesforce Agentforce, presenting a unified view alongside customers’ internal and third-party APIs. This comprehensive visibility empowers organizations to easily manage these interactions and effectively detect and block sensitive data leaks, whether from external AI harvesting or internal AI usage.
  • Seamless integration: Integrates easily into DevOps frameworks for discovering internal AI applications and generates OpenAPI specifications that detail API schemas and security mechanisms, including strong authentication and security policies. Cequence delivers powerful protection without relying on third-party tools, while seamlessly integrating with the customer’s existing cybersecurity ecosystem. This simplifies management and security enforcement.

“Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, enabling 15% of day-to-day work decisions to be made autonomously. We’ve taken immediate action to extend our market-leading API security and bot management capabilities,” said Ameya Talwalkar, CEO of Cequence. “Agentic AI introduces a new layer of complexity, where every agent behaves like a bidirectional API. That’s our wheelhouse. Our platform helps organizations embrace innovation at scale without sacrificing governance, compliance, or control.”

These extended capabilities will be generally available in June.

Continue Reading

Cyber Security

Commvault Enhances Cyber Recovery Offerings with CrowdStrike Incident Response

Published

on

Commvault has announced an expanded partnership with CrowdStrike. Together, the companies are delivering a trusted pathway to CrowdStrike’s elite incident response services, supported by Commvault’s recovery expertise — helping organisations worldwide recover faster and stay better prepared for cyberattacks.

Through this expanded partnership, the two companies are delivering coordinated cyber recovery and incident response services to help joint customers improve readiness, respond faster, and achieve cleaner recoveries. With ransomware attacks happening every 14 seconds and average recovery times spanning 24 days, IT and security teams, as well as system integrators, are looking for vendors who are collaborating and combining best-in-class services and solutions. These efforts not only address what happens before and during an attack but also support recovery when it becomes a critical lifeline for organisations.

“Today’s threat landscape demands more than just security – it requires resilience,” said Alan Atkinson, Chief Partner Officer at Commvault. “Our expanded partnership with CrowdStrike brings together exceptional incident response capabilities from CrowdStrike and leading data recovery and resilience solutions from Commvault to help joint customers identify and quickly address cyber incidents and recover swiftly and effectively.”

“Cyber resilience isn’t just about recovery, it’s about being ready at every stage of an attack,” said Daniel Bernard, Chief Business Officer at CrowdStrike. “Our expanded partnership with Commvault brings together industry-leading threat intelligence, incident response expertise, and robust recovery capabilities to help organisations identify risks faster, recover smarter, and strengthen their overall security posture. In an AI-accelerated world of relentless and sophisticated threats, security and IT teams need to operate as one, and this collaboration helps make that possible.”

This expanded partnership delivers a unified suite of services, including CrowdStrike’s elite incident response services and Commvault’s Guardian retainer-based services offerings, which provide readiness assessments, recovery validation, recovery testing, and incident response recovery assistance. For customers, this means:

  • Faster incident response and recovery: In the event of a cyber incident, CrowdStrike’s real-time threat visibility pinpoints the scope of the attack, while Commvault’s recovery solutions enable rapid restoration. This integrated approach streamlines the incident response process and helps minimise disruption.
  • Enhanced risk mitigation: Jointly conducted cyber resilience maturity assessments and advanced scenario-based readiness exercises — including continuous recovery testing with Cleanroom Recovery — strengthen cyber resilience.
  • Unified incident management: Integrated response workflows between Commvault and CrowdStrike enable faster collaboration during crises, accelerating time to resolution for joint customers.
  • Tailored support and scalability: Commvault’s incident response recovery services provide scalable, subscription-based support tailored to each customer’s specific resilience needs.
  • Access to industry expertise: Customers benefit from the combined expertise of Commvault and CrowdStrike, with tailored guidance and hands-on support from trusted cybersecurity and recovery professionals.
Continue Reading

Cyber Security

Bugcrowd Launches Crowdsourced Red Team as a Service

Published

on

Bugcrowd has launched an offering to apply the scale, agility, and incentive-driven power of crowdsourcing to red teaming. This new service connects customers with a global network of vetted ethical hackers for a variety of red team engagements—fully managed through the Bugcrowd Platform. This release sets a new benchmark in the red team services market, enabling organizations to test their security environments with the highest level of confidence. By tapping into a global pool of experts using the latest adversarial tactics, techniques, and procedures (TTPs), customers gain unparalleled insight into how real-world attackers would attempt to breach their defenses.

Available on the Bugcrowd Platform, RTaaS works seamlessly alongside offerings such as Penetration Testing as a Service, Managed Bug Bounty, and Vulnerability Disclosure Programs. Bugcrowd customers can tailor their RTaaS engagements to meet specific needs, budget constraints, and organizational maturity. Through Bugcrowd’s global talent pool of vetted, trusted ethical hackers, customers can secure the exact expertise they need and scale their RTaaS program over time, surpassing competing services on the market today.

“Traditionally, red teaming was only possible for large organizations that could either afford the services of security consultants or had a sizable security workforce to manage the workload alongside daily operations—and even then, findings were too often not actionable. Bugcrowd’s industry-first offensive crowdsourced RTaaS bridges this critical security gap, opening the door for our customers to access high-end capabilities that deliver crucial insights into their defensive posture—continuously,” says Dave Gerry, CEO of Bugcrowd. “Bugcrowd was founded on the bug bounty hunter mindset, an objective that aligns perfectly with Red Team operators. This launch is a significant milestone for Bugcrowd as it brings a pioneering solution to life. We are excited to see the power of The Crowd in action in RTaaS and enhance our customers’ always-on approach to security testing.”

Due to the persistent and sophisticated campaigns of cybercriminals, the cost of breaches continues to rise. As enterprise environments become more complex, organizations understand the need to stay ahead of these advanced threats. While pen testing and bug bounties will remain crucial tools in identifying vulnerabilities, Bugcrowd RTaaS enhances organizational preparedness by simulating real-world attacks, allowing understanding of detection and response capabilities, and exposing gaps in security controls that traditional testing may miss.

“As a hacker, I’m genuinely excited about Bugcrowd’s new Red Team as a Service (RTaaS) offering. RTaaS builds on the strengths of traditional bug bounty and Penetration Testing as a Service, taking them to the next level by allowing organizations to safely test their defenses against real-world attack scenarios,” said Matt Byrdwell, aka Nerdwell, ethical researcher and hacker at Bugcrowd.” Red Teaming is the most effective way to evaluate how well an organization’s layered security controls work together to create a true defense-in-depth strategy—and to safely identify any gaps. By simulating realistic attacks in a structured, controlled environment, RTaaS is a great way for cybersecurity teams to demonstrate the value of a strong security posture to both the business and its leadership.”

Key features of RTaaS on the Bugcrowd Platform:

  • Threat intelligence aligned with realistic scenarios: Bugcrowd RTaaS Integrates threat intelligence and risk profiling to simulate realistic, regulation-ready scenarios.
  • Real-world adversarial tactics: Operators mimic the behaviors of nation-state actors, organized cybercriminals, and insider threats to authentically test an organization’s ability to detect, respond to, and contain advanced attacks.
  • Global pool of specialized operators: Access a diverse network of vetted operators skilled in advanced tactics tailored to your environment and threats.
  • Integrated platform and workflows: Receive comprehensive reports with visual attack chains, attack narratives, and findings mapped to root causes and security controls.
  • Scalable and flexible: Capitalize on assured, blended, or continuous red team operations to match various budgets, regulatory obligations, and security maturity levels.
  • High return on investment: Take advantage of flexible pricing options, including day-rate engagements, reward pools, and continuous programs, to suit a range of needs, budgets, and objectives.

Bugcrowd’s RTaaS is now available to all customers on the Bugcrowd Platform.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.