The Security Boulevard stories enterprise IT leaders actually read.
Volume 343, Issue 1 · 16 articles from 2 issues
A primer on how C2 channels work and what they look like from the network rather than the endpoint.
This primer explains how command-and-control communication lets attackers operate compromised systems and manage malware, then covers what those channels look like from the network layer.
The detection value of network-level analysis is that it survives endpoint agent tampering, which modern malware routinely attempts.
The article covers beaconing patterns, protocol abuse and the indicators that remain visible even when traffic is encrypted. It is a solid technical foundation for teams building network detection capability rather than relying entirely on endpoint telemetry.
An analysis of 1,000 SOC job postings shows hiring has shifted decisively toward engineering over analysis.
An analysis of 1,000 security operations job postings found teams hiring roughly three engineering-oriented roles for every traditional analyst position.
The shift reflects where the work now is: building detections, automating response and maintaining data pipelines rather than reviewing alert queues.
For security leaders it has immediate implications for job descriptions, compensation bands and training investment. For analysts it is a clear signal about which skills to develop.
The methodology is transparent enough that readers can judge how well the sample matches their own market.
A joint SentinelOne and Tenable report identifies the specific edge platforms attackers return to repeatedly.
A joint SentinelOne and Tenable report identifies the specific edge computing platforms that attackers target repeatedly, finding the attention concentrated on a narrow set of products rather than spread across the category.
That concentration is actionable: organizations can prioritize hardening and monitoring for the named platforms rather than treating all edge devices as equivalent risk.
The report also covers which vulnerabilities in those platforms are exploited most consistently, which is more useful for prioritization than severity rating alone given how many edge advisories are published.
Unsupported software creates compounding cost, reliability and reputation problems beyond the obvious security gap.
Unsupported software creates problems that extend well past the missing security patches everyone focuses on.
The article works through the compounding costs: reliability degrades as the surrounding platform moves on, integration options narrow, staff with the relevant knowledge become harder to find and more expensive, and the eventual migration grows more difficult each year it is deferred.
It also covers how to build a defensible end-of-life inventory and how to present the accumulating cost in terms that make deferral visibly expensive rather than free.
ETR data projects security software spending growing 7.8 percent while AI costs squeeze other IT budget lines.
ETR data indicates security software spending is projected to grow 7.8 percent even as AI costs force reductions elsewhere in enterprise IT budgets.
The finding is useful context for security leaders in planning conversations: security is holding its position relative to other lines rather than benefiting from growth, and the pressure is coming from AI reallocation rather than reduced threat concern.
The article breaks down which security categories are growing and which are flat, which matters for anyone timing a renewal or proposing a new capability.
Security Boulevard's weekly breach roundup, led by an Oracle Health/Cerner incident that may affect nearly 20 million people.
Security Boulevard's weekly after-action report reviews the most important breaches across sectors including healthcare, public services, energy, finance, retail, education and technology, separating confirmed exposure from unresolved scope and attacker claims.
Topping the list is Oracle Health/Cerner, where attackers used stolen customer credentials to access two legacy Cerner servers not yet migrated to Oracle Cloud, and Texas filings suggest nearly 20 million people may be affected, though Oracle hasn't confirmed it.
The takeaway is to rotate credentials and isolate unmigrated systems during cloud migrations.
LoginRadius founder Deepak Gupta picks the best podcast episodes on six major breaches, from SolarWinds to NotPetya and XZ Utils.
In a post syndicated to Security Boulevard, LoginRadius founder Deepak Gupta curates podcast episodes that best explain major breaches, noting the strongest were recorded close to events, often by people who worked on them.
Picks include Malicious Life on SolarWinds, Darknet Diaries on NotPetya, Andres Freund on XZ Utils and Microsoft researchers on Scattered Spider.
For each of six breaches he offers a short first listen and a deeper episode, verified against show feeds as of October 1, 2026, plus a primary source such as a CISA advisory, viewing each breach through where identity failed.
Elastic previews AlertZero, AI agents inside its SIEM that triage alerts, investigate, hunt threats, tune detections and do forensics.
At its Elastic{ON} event, Elastic previewed AlertZero, a layer of agentic AI embedded in its SIEM platform whose agents handle alert triage, investigation, threat hunting, detection tuning and forensic analysis.
The agents can run anywhere and use any preferred AI model to analyze structured and unstructured data, logs and metrics.
Mike Nichols, general manager of Elastic Security, says teams won't need a separate AI SOC because the SIEM is already their trusted source of truth, and AI is needed to remove tedious work as alert volumes grow with more AI agents deployed.
Escape explains Gartner's continuous offensive security testing model, which runs adversary-style tests whenever something material changes.
In an Escape blog syndicated to Security Boulevard, continuous offensive security testing (COST), a term introduced by Gartner, is described as running adversary-style tests whenever something material changes, such as a release, a new internet-facing asset or a control change, instead of an annual pentest.
Offensive security spans vulnerability assessment, penetration testing and red teaming, and findings should count only once reproduced in your own environment with the requests and identities needed to repeat them, then rerun as regression tests.
The guide includes a small local test harness readers can run.
Attacks exploit gaps between physical and cyber security teams, so organizations should manage the two disciplines together.
This Security Boulevard article argues that most organizations still split physical security from cybersecurity, even though many damaging incidents exploit the gaps between them.
Examples include a phishing email, a contractor whose network access is never revoked or a network-connected camera left unsecured, while attack surfaces now extend to cloud services, hybrid workforces, vendors, smart buildings and IoT devices.
Because threats have no perimeter, the two disciplines must be managed together.
Hyperproof vendor post pitching its GRC platform's framework library, crosswalks and 200+ integrations over tracker-style tools.
In a vendor post syndicated to Security Boulevard, Hyperproof argues most GRC platforms are trackers that log work without reducing manual effort, forcing teams to re-map controls for each framework and coordinate audit prep by hand across siloed departments.
Hyperproof promotes what it calls the largest pre-built framework library, with Crosswalk and Jumpstart features mapping requirements from 160+ framework programs across nearly 2,500 domains so evidence can be reused.
It also cites 200+ integrations that collect evidence on demand or on a schedule from cloud and business systems.
Dispersive argues AI's next era depends on stealthy, resilient networking, since adversaries target traffic patterns, not encryption.
In the final post of a series syndicated to Security Boulevard, Dispersive argues that as AI becomes the operational core of organizations, with inference moving to the edge, the network becomes AI's critical dependency.
Earlier posts in the series covered legacy secure networking limits, side-channel exposure and AI workload requirements.
Dispersive predicts stealth will become the default, since adversaries will target the network layer not to break encryption but to observe patterns, disrupt inference or infer sensitive activity.
Grip explains how to build a continuously updated AI inventory of apps, embedded features, agents and their access to data and systems.
A Grip Security blog syndicated to Security Boulevard defines an enterprise AI inventory as a continuously updated record of AI applications, embedded features, agents, integrations and identities, plus their access to business systems and data.
A trustworthy inventory records how each item was found, who owns and uses it, what it can reach and when facts were last checked.
Security teams should combine evidence from procurement, identity systems, SaaS integrations, browser activity and app owners, then map AI to identities and permissions and review changes over time.
Above Security's CPTO explains how to use AI to investigate AI agents as insider risks without making it the sole authority over evidence.
In an Above Security post syndicated to Security Boulevard, the company's CPTO responds to Satya Nadella's essay arguing that capable AI models should be treated as insider risks, subject to the observation, access control, auditing and containment applied to privileged humans.
Nadella's line, 'separate the supply of intelligence from the authority over it,' frames the design, resolving the apparent paradox of one model judging another by letting AI reason about behavior without being the sole authority over the evidence.
That starts with independently observing each AI agent rather than just feeding logs to an LLM.
GitGuardian draws on nine real AI agent incidents to recommend six controls, from sandboxing to deny-by-default, that limit blast radius.
A GitGuardian post syndicated to Security Boulevard says AI agents expose three attack surfaces: the host, the identity they act as and the agent itself.
Nine public incidents between May 2025 and July 2026 hit all three, and in injection cases the instruction opened the door while the credential was the real target.
Six controls limit the blast radius, including sandboxing the agent, scoping its credentials, logging every call and denying by default, though none of them prevent prompt injection itself.
A walkthrough of using Amazon Bedrock AgentCore Identity so an AI agent on EC2 can get OAuth tokens to call GitHub securely.
This Security Boulevard tutorial shows how to use the identity service of Amazon Bedrock AgentCore, AWS's platform for building and orchestrating AI agents, on its own with an agent running on EC2.
AgentCore Identity provides an agent-focused identity directory built on Cognito, a token vault for API keys and credentials, built-in two- and three-legged OAuth 2.0 and on-behalf-of token exchange, so agents can reach external resources without handling client secrets.
The guide builds a scenario in which the agent calls the AgentCore Identity API for an access token and uses it to access GitHub.
More from Security Boulevard · All IT section newsletters · This week