This week at a glance
The agentic SOC argument moved from product launches to staffing this week. At CRN’s XChange conference, Arctic Wolf CEO Nick Schneider said the company’s analysis of what it takes to run a SOC found about 75% of the roles could be “almost entirely agentic”, leaving humans with trust, oversight and customer interaction. 7AI’s Lior Div, at the same event, said he is building a company on the scale of Palo Alto Networks or CrowdStrike, sold entirely through partners. The defenders are more cautious. Flashpoint’s 2026 enterprise threat intelligence report puts active use of agentic AI in cyber defence at 25%, with another 20% in a closed pilot and 20% with no plans at all. One respondent put the concern plainly: “An agent that’s confidently wrong is worse than one that’s slow.”
The most useful evidence this week is about what an agent should be allowed to decide. Sola Security had an AI agent re-grade 9,967 high-severity findings from two commercial cloud security platforms, using evidence from each environment. It changed three in four grades, mostly downward, and half of its verdicts depended on evidence outside the flagged resource. Its rule is worth copying: raising a severity needs more evidence than lowering it. Trellix answered a different objection, data leaving the building, with an on-premises version of Wise that never sends data to a public model and records its reasoning in an auditable dossier. A Capital One engineer’s five questions for every AI agent, and Intezer’s “collect the evidence first, then decide”, make the same point from the governance side.
Outside the agent debate, the week was busy. Proofpoint agreed to buy Varonis for about $6.3 billion in cash, the year’s largest security deal so far. Microsoft fixed a record 1,411 flaws, including an exploited Mark of the Web bypass, alongside 55 wormable bugs. SonicWall’s CVSS 10 SMA1000 flaw drew exploitation attempts two days after disclosure. Fortinet, Ivanti, Citrix, SAP and Drupal all shipped critical fixes, and Drupal warned that exploits could follow “within hours or days”. Signals Corps found 30 websites trying to inject instructions into AI agents through HTTP headers. CSO reports that AI-rebuilt Midnight Blizzard malware was still caught by its behaviour. Deepfake fraud losses keep growing, and Gartner warns that most quantum migration plans are already behind.
On our watch list
- Arctic Wolf’s agent observability release. Schneider says capabilities that let partners see what Arctic Wolf’s agents are doing will ship “within the coming months”. The test is whether partners and customers get decision logs they can audit, not only dashboards, and whether any customer publishes how many SOC roles actually moved to agents.
- Whether the Flashpoint numbers move. Only 25% of teams use agentic AI in active defence today, and 35% are looking at adoption over the next 12 to 24 months. Watch next year’s surveys for movement out of the closed-pilot stage. That shift would show trust building faster than the vendor messaging suggests.
- Replication of the cloud-findings re-grading study. Sola Security’s agent downgraded 58.5% of high-severity findings and upgraded 16.6%, but the study measured reading only, covered two platforms and had no incident data. Look for MEDIUM and LOW queues, other clouds and, above all, outcome data on downgraded findings that later turned out to matter.
- Trellix Wise for Private Cloud availability and pricing. Trellix has named no general availability date or price, only that predictable pricing replaces token-based charges. A named regulated customer running it air-gapped would show whether on-premises AI investigation is practical at scale.
- Proofpoint-Varonis regulatory review and the roadmap. The deal is expected to close in the first half of 2027, and the two companies stay independent until then. Watch for antitrust filings and for how Proofpoint plans to fold Varonis’s managed data detection and response service and its Atlas AI security product into a single platform.
- Exploitation of the Drupal and SAP critical flaws. Drupal warned that exploits for the Field UI and Entity List RCEs could appear within hours or days, and SAP’s 10.0 Cloud SDK for Python SSRF affects multi-tenant BTP applications. Neither is reported exploited yet. A KEV listing or public proof-of-concept would raise the priority for both.
- FortiSIEM and the security tooling attack surface. SecurityWeek lists critical unauthenticated code execution and authentication bypass flaws in FortiSIEM and FortiSandbox. Watch for exploitation reports against SOC infrastructure itself, where a compromised SIEM blinds the team that depends on it.
- Microsoft’s risk cohorts in practice. Microsoft grouped October’s flaws into 15 risk cohorts but says they do not indicate which flaws are most dangerous. See whether patch-management vendors and vulnerability scanners adopt the cohorts for prioritisation, or whether teams keep ranking by exploitation status.
- Header-based prompt injection beyond pranks. 22 of the 30 header injections Signals Corps found were jokes. The signal to watch is the first injection that targets a specific agent or tool, such as a coding assistant fetching documentation, or one that pairs a header with a redirect to attacker-controlled content.
- Next AI-assisted malware case with two independent sources. CSO calls the Midnight Blizzard case the clearest on record because ReversingLabs and Anthropic described the same infrastructure. The next confirmation will show whether behaviour-based hunting keeps pace as attackers start rebuilding server-side infrastructure as well as code.
- Quantum timelines in budget cycles. Gartner’s Sarah Almond says 61% of organisations lack full visibility of their cryptography and that conventional asymmetric cryptography will be unsafe by 2030. Watch for cryptographic inventory and crypto-agility lines appearing in 2027 security budgets and in vendor procurement questionnaires.
This week’s topic map: the agentic SOC market (Arctic Wolf, 7AI, Exaforce) against defender caution (Flashpoint), evidence-backed AI verdicts (Sola Security, Trellix), the Proofpoint-Varonis deal, a record patch week (Microsoft, SonicWall, Fortinet, Ivanti, SAP, Drupal), header-based prompt injection, AI-rebuilt malware, deepfake fraud and Gartner’s quantum warning.
View interactive topic map →
Article index
The agentic SOC: market and adoption
Vendors and investors are betting on agents running most of the SOC; defenders are adopting more slowly. The two CRN rows are CEO interviews at a channel conference. The Exaforce funding round was first announced in May and is re-reported here. The Hacker News decision-model piece is by Intezer, and The Forecast is published by Nutanix.
Evidence, context and the data layer
What an AI verdict should rest on, and who owns the detection content and data it uses. The Trellix launch is a vendor announcement and the cloud-findings study is Sola Security research. The Kaseya, Cato Networks and Command Zero pieces are vendor-authored, and the SIEM architecture report was sponsored by Datadog and Scanner (disclosed).
Patch and exposure week
A record Microsoft release, a SonicWall flaw exploited within two days, critical Fortinet, Ivanti and Citrix fixes, SAP and Drupal criticals, plus two pieces on remediation practice. The Qualys interview is with a Qualys executive and the agentic pentesting piece is sponsored by Picus.
| Article |
Source |
Published |
| 15. Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days |
BleepingComputer |
Oct 13, 2026 |
| 16. Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951) |
Help Net Security |
Oct 14, 2026 |
| 17. Critical SonicWall Vulnerability Exploited Days After Disclosure |
SecurityWeek |
Oct 12, 2026 |
| 18. Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products |
SecurityWeek |
Oct 14, 2026 |
| 19. SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities |
SecurityWeek |
Oct 14, 2026 |
| 20. Drupal patches critical RCE flaws, warns exploits may emerge soon |
BleepingComputer |
Oct 17, 2026 |
| 21. Patching and preventing issues: What are the lessons you can learn? |
Help Net Security |
Oct 14, 2026 |
| 22. The Blind Spots of Agentic Pentesting and How to Close Them |
BleepingComputer |
Oct 14, 2026 |
Attacks on people and on agents
Prompt injection aimed at AI agents through HTTP headers, AI-rebuilt malware that behaviour still catches, deepfake payment fraud, and the sign-in paths attackers still use after passkeys. The passkeys post is from Huntress.
Consolidation and the long horizon
The year’s largest security acquisition, and a Gartner analyst’s opinion piece on why post-quantum migration needs to start now.
Detailed write-ups
1. Agents could fill 75% of SOC roles, vendors say. Defenders are not there yet
CRN · Infosecurity Magazine · The Economic Times · October 12–15, 2026
Arctic Wolf CEO Nick Schneider told CRN editors at the XChange Best of Breed conference in Atlanta that the company had analysed what it takes, at minimum, to operate a SOC. “You can get about 75 percent of the roles to be almost entirely agentic,” he said. “What you’re really leaving, to the human, is some level of trust and interaction.” How far that goes will vary from customer to customer, depending on where each one sets its trust threshold. Arctic Wolf is building features that let partners see what its agents are doing, and expects to ship them within months. At the same conference, 7AI’s Lior Div said he aims to build a company the size of Palo Alto Networks or CrowdStrike. His first hire was a head of channel, and every deal 7AI has closed has involved a partner. He says AI can finish in under ten minutes an investigation that takes an analyst 30 to 60 minutes. The Economic Times re-reported Exaforce’s $125 million round, first announced in May, which takes the company to $200 million in total funding. Exaforce’s pitch is a real-time knowledge graph of identities, permissions and cloud activity, which it says lets its agents finish an investigation in under a minute.
Defenders are slower to commit. Flashpoint’s Enterprise Threat Intelligence Report 2026 finds that 25% of security teams use agentic AI in active cyber defence, 20% are running a closed pilot, 35% are examining adoption over the next 12 to 24 months and 20% have no plans to test it. Budgets are not the constraint: 35% expect security spending to rise by more than 10%, and none expect a cut. Today’s uses are retrieval, alert prioritisation, IP blocking and blocklist updates. The objections are wrong decisions, data leakage, auditability, regulation, cost and how much control to hand over. “They’re holding agentic AI to a high bar,” said Flashpoint CEO Josh Lefkowitz. For SOC leaders, the useful number in Schneider’s claim is the remaining 25%. It covers the oversight, approval and customer-facing work that teams must design and staff on purpose, and it should not simply be whatever the agents leave behind.
Sources: CRN (Arctic Wolf CEO: 75 Percent Of SOC Roles Could Become Almost Entirely Agentic) · CRN (7AI CEO Lior Div On Building Up A ’Generational Company’ In Agentic SOC With The Channel) · Infosecurity Magazine (Defenders Reluctant to Deploy Agentic AI as a Cybersecurity Tool) · The Economic Times (Cybersecurity firm Exaforce raises $125 million from HarbourVest, Peak XV, Khosla Ventures)
2. Proofpoint buys Varonis for $6.3 billion in cash
SecurityWeek · October 16, 2026
Thoma Bravo-owned Proofpoint agreed to acquire Varonis for $49.75 a share in cash, about $6.3 billion. That is a 52% premium to Varonis’s $32.71 close on June 22, the last full trading day before sale rumours surfaced, and the largest cybersecurity acquisition announced so far this year. Thoma Bravo is providing committed equity and debt financing has been secured, and the Ontario Teachers’ Pension Plan is also investing in Proofpoint. The deal is expected to close in the first half of 2027. The two companies will run independently until then. Afterwards Varonis becomes private and Proofpoint plans to combine the two into a single data and AI security platform.
For security operations teams the overlap is in data and insider detection. Varonis brings its SaaS data security platform, which finds and classifies sensitive data, maps who can access it and monitors its use. It also brings Atlas for AI systems (AI inventory, posture management, testing and runtime guardrails), an email and browser security product, and a managed data detection and response service. Proofpoint already sells DLP, insider risk management, DSPM and an AI Security product launched this year, and it bought Acuvity in February. SecurityWeek’s report carries no executive or analyst comment, so the integration plan is all there is to go on for now. Customers of either company should expect product roadmaps and contracts to come up for discussion before the 2027 close.
Sources: SecurityWeek (Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis)
3. Let the agent re-grade the finding, but make it prove the downgrade
Help Net Security · October 13, 2026
Sola Security researchers Leon Goldberg and Gal Engelberg had an AI agent re-check 9,967 high-severity findings from two commercial cloud security platforms across eight production environments, 92% of them on AWS. For each finding the agent built a theory of how an attacker would exploit it and gathered evidence from the resource, connected resources and other security tools. It changed 75.1% of the grades: 58.5% went down and 16.6% went up. Almost half the verdicts (49.0%) relied on evidence from outside the flagged resource. The most common pattern, 32.3% of checkable findings, was a finding on an inert resource that was unattached or orphaned. The evidence policy was deliberately lopsided. Raising a severity required proof that the condition was worse plus a check for guardrails, while lowering one required an observed property that blocked the exploit path. Otherwise the vendor’s grade stood. Read-only probes confirmed the agent’s deciding facts 99.4% of the time where they could be checked, falling to 81.8% if unverifiable findings are counted as wrong. The authors are clear about the limits: the study measured reading, not acting, and “reading and acting differ in blast radius, reversibility, and authorization.”
Trellix addressed a different barrier to adoption, data leaving the building. Wise for Private Cloud is an on-premises, federated AI engine for agentic security operations. It runs in air-gapped, hybrid and private cloud environments, reads data where it sits without a separate data lake, and never sends data to a public LLM or external cloud. Trellix says it investigates every alert it receives. Each verdict comes with a confidence level, a plain-language explanation and a dossier documenting the AI’s reasoning, and pricing is fixed rather than per token. No availability date or price was given. IDC’s Christopher Kissel notes that for some buyers “cloud dependency alone can be disqualifying”. Taken together, the two stories suggest a design rule for any triage agent: require evidence before it lowers a severity, keep the reasoning where an auditor can read it, and keep human approval on actions until the reading has been verified.
Sources: Help Net Security (Most high-severity cloud security findings are downgraded once an AI agent checks the environment) · Help Net Security (Trellix Wise for Private Cloud delivers auditable AI investigations for security teams)
4. A record patch week: 1,411 Microsoft fixes, SonicWall exploited in two days
BleepingComputer · Help Net Security · SecurityWeek · October 12–17, 2026
Microsoft’s October release fixed about 1,411 flaws, a record, not counting 348 fixed earlier in the month. 70 are rated critical, 57 of them remote code execution. One zero-day is exploited: CVE-2026-96951, a Windows Shell flaw that bypasses Mark of the Web. A crafted file arriving by email, chat, Teams or Slack, or by download, opens without the usual warning or Protected View once the user runs it. Tenable’s Satnam Narang says it is the third Windows Shell flaw exploited this year. Two more flaws were publicly disclosed: a .NET Framework bypass of Windows Defender Application Control (CVE-2026-108398, found by Google Project Zero’s James Forshaw) and a MessagePack-CSharp denial of service. Microsoft also fixed 55 wormable bugs in DHCP Server, RD Gateway and Network Policy Server, and a critical Azure SRE Agent privilege escalation. This is the last update for Windows 11 24H2 Home and Pro. Microsoft has started grouping flaws into 15 “risk cohorts”, but says the cohorts do not indicate which flaws are most dangerous. ZDI’s Dustin Childs says the volume “isn’t the real story anymore. What matters is that discovery is scaling faster than exploitation.”
The edge devices moved faster. SonicWall disclosed CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in SMA1000 appliances, on October 6. Defused saw exploitation attempts against its decoys two days later, and Previdian reported more. Fixes are in 12.5.0-03082 and 12.4.3-03670. Citrix, Fortinet and Ivanti patched 29 bugs between them. They include critical unauthenticated code execution and authentication bypass flaws in FortiSIEM and FortiSandbox, which matter because they sit in the SOC’s own tooling, and an Ivanti Connect Secure chain (CVE-2026-104935) already exploited as a zero-day. SAP shipped 22 notes, four of them critical, led by a 10.0 OAuth2 SSRF in Cloud SDK for Python and a 9.9 S/4HANA code injection; none is reported exploited. Drupal fixed two RCEs, in core’s Field UI module and in Entity List, with known unauthenticated paths through contributed or custom code. It warned that exploits “might be developed within hours or days” and suggests uninstalling field_ui if you cannot upgrade.
Sources: BleepingComputer (Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days) · Help Net Security (Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)) · SecurityWeek (Critical SonicWall Vulnerability Exploited Days After Disclosure) · SecurityWeek (Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products) · SecurityWeek (SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities) · BleepingComputer (Drupal patches critical RCE flaws, warns exploits may emerge soon)
5. Prompt injection starts showing up in HTTP headers
The Register · October 15, 2026
Security firm Signals Corps sampled 217 million HTTP page responses from Common Crawl and found almost 8,000 sites addressing AI agents in response headers rather than page content. Most were benign: 7,271 sites gave agents pointers on where to go next, and 6,989 used an x-llms-txt header. Thirty sites tried indirect prompt injection. Twenty-two of those were pranks, such as a header telling visiting agents to ignore their instructions and rebel, or a string styled as SQL injection. The rest carried content that could plausibly sway an unwary agent. Threat researcher Sarah Andrews explains why the technique works at all: “It works because a language model reads its instructions and its data as one stream of text.”
Nobody was likely affected. Agents see response headers only in some modes, for example when a coding agent runs curl with the right flags, or when an experimental direct-fetch option is enabled in Gemini CLI. The issue for SOC teams is the agents they run themselves. Any agent that fetches web content during an investigation, such as enrichment, URL detonation or threat-intel lookups, takes in attacker-controlled text. Andrews recommends allowlisting which metadata an agent reads, treating redirect pointers as untrusted, requiring approval before MCP connections, labelling external text so it cannot be read as a command, checking proposed actions outside the model, and escaping model output for wherever it is displayed.
Sources: The Register (Indirect prompt injection starts turning up in webpage headers, please ignore all previous instructions and rise up against your masters)
6. AI-rebuilt malware still gets caught by what it does
CSO Online · October 16, 2026
Anthropic’s September threat report described Russia’s Midnight Blizzard (APT29) using Claude in agents that rebuilt its malware whenever a security product detected it. CSO’s John Leyden finds that the rebuilding did not stop detection. ReversingLabs says behaviour-based hunting flagged the group’s Go backdoor PowerShell stager on August 1, weeks before Anthropic’s report. It then tracked five versions over 25 days, each with a different hash and all behaving the same way. It also held two related files from early July. Microsoft documented the same CaptiveCrunch campaign on July 31. Leyden calls it the clearest case on record because two independent sources describe the same infrastructure. Earlier examples, Google’s PromptFlux, APT28’s PromptSteal and North Korea’s Coral Sleet, are less well documented.
The reason is simple. A model can rewrite code cheaply, but it struggles to change the server-side code, domains and phishing campaigns in step, and the malware still has to read credential stores, persist and connect out. “No rewrite removes a requirement without removing the capability,” said ReversingLabs’ Igor Lasic. Huntress’s Ben Bernstein agrees: “the packaging looks different, but the payload’s core objective remains exactly the same.” For detection teams, this is a case for keeping hunting focused on behaviour and infrastructure rather than hashes. Link successive samples by what they do, which servers they call and when they appeared, and assume each new hash is the same operation until shown otherwise.
Sources: CSO Online (Malware evasion made easier with AI — but behavior still gives it away)
7. Deepfake fraud: verify the request, do not judge the face
TechTarget · October 12, 2026
Two years after an Arup employee approved $25.6 million in transfers following a deepfake video call with a fake CFO and colleagues, the losses are getting bigger. In September, according to Reuters, fraudsters used voice cloning and impersonation to get executives at Intesa Sanpaolo’s Fideuram unit to authorise transfers totalling about €95 million. Regula’s survey found that the share of businesses reporting video deepfake fraud rose from 29% in 2022 to 49% in 2024, and Gartner found 62% of organisations had faced a deepfake attack in the previous year. Detection tools are in “a race between generation and detection”, says Dig CEO Ofer Familier, so the experts quoted treat them as a supplement and not the main control.
The controls that work target the request rather than the media. Require out-of-band verification for any request involving money, credentials, access or sensitive data, executives included, through a channel the requester did not supply. Require more than one approver for sensitive actions. Run scenario training built around a fake CFO video call, and watch public platforms for impersonations of your executives. When a fraud is found, security, legal and communications teams should together stop the transaction, secure the accounts and preserve evidence. “Companies cannot prevent someone from creating a deepfake, but they can prevent employees from acting on one,” said Sherli Furst of Ellenoff Grossman & Schole. For the SOC, that means payment-change and help-desk reset requests belong in the same playbooks as phishing.
Sources: TechTarget (Beyond Arup: CISOs combat escalating deepfake fraud)
8. Gartner: the quantum migration is already behind
TechRadar Pro · October 16, 2026
Writing for TechRadar Pro, Gartner director analyst Sarah Almond says Gartner predicts that by 2030 “advances in quantum computing will make conventional asymmetric cryptography unsafe to use”. Yet 61% of organisations lack full visibility into their own cryptographic systems. Replacing cryptography, she argues, is a multi-year transformation and not a patch cycle, so waiting for a confirmed date for a working quantum computer means starting too late. Data that has to stay confidential beyond 2030, such as government records, medical files, intellectual property and long-lived identity credentials, should be protected first.
Her programme starts with an inventory: scan the estate, catalogue cryptographic components and feed the results into technical-debt tracking. Next comes crypto-agility, the ability to change algorithms, keys and protocols without re-engineering systems, with hybrid classical and post-quantum cryptography as a transition rather than an end state. She recommends a cross-functional Cryptographic Centre of Excellence covering developers, cloud and network, identity and procurement, and says procurement should ask vendors about the cryptography bundled in third-party software. For security operations, the practical first step is to add cryptographic assets to the inventory and scanning tools the team already runs. The piece is an opinion column, and the 61% and 2030 figures are given without the underlying Gartner report.
Sources: TechRadar (Gartner: The quantum threat is already behind schedule)
Calls to action
- Patch CVE-2026-96951 first. The Windows Shell Mark of the Web bypass is exploited and arrives through email, chat and collaboration tools. Deploy it ahead of the rest of October’s release, then schedule the 55 wormable DHCP Server, RD Gateway and NPS fixes.
- Upgrade SonicWall SMA1000 now. Move to 12.5.0-03082 or 12.4.3-03670 and review appliance logs from October 6 onward. Exploitation attempts began two days after disclosure.
- Patch the SOC’s own tools. Apply Fortinet’s FortiSIEM and FortiSandbox fixes and the Ivanti Connect Secure update (its chain is already exploited), and restrict management interfaces on security tooling to admin networks.
- Update Drupal or remove Field UI. Upgrade to Drupal 10.6.19, 11.3.19 or 11.4.10 and Entity List 3.0.10. Where you cannot, uninstall the field_ui module until you can.
- Patch SAP’s four critical notes. Prioritise the Cloud SDK for Python OAuth2 SSRF on multi-tenant BTP applications and the S/4HANA Fiori code injection.
- Plan Windows 11 24H2 Home and Pro replacements. October was the last security update for those editions and for Windows 10 Enterprise LTSB 2016. List remaining machines and schedule upgrades.
- Make downgrades harder than upgrades. If an AI agent or analyst workflow can lower a finding’s severity, require recorded evidence of an offsetting control first, and log the reasoning where an auditor can read it.
- Treat fetched web content as hostile input for your agents. For any SOC agent that browses or enriches URLs, allowlist which headers and metadata it reads, label external text as data, and require approval before new MCP connections or response actions.
- Hunt by behaviour, not hash. Make sure detections cover credential-store reads, new persistence and unusual outbound connections, and cluster related samples by infrastructure and timing.
- Add out-of-band verification to payment and reset playbooks. Require a callback through a known channel and a second approver for payment changes, executive requests and help-desk MFA resets, regardless of how convincing the voice or video is.
- Lock down passkey enrolment and recovery. Require strong proof before adding an authenticator or resetting MFA, alert on new authentication methods and device-code sign-ins, and revoke sessions and remove unknown authenticators when compromise is confirmed.
|