{"id":5930,"date":"2026-09-20T13:23:27","date_gmt":"2026-09-20T18:23:27","guid":{"rendered":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5930"},"modified":"2026-09-20T13:23:27","modified_gmt":"2026-09-20T18:23:27","slug":"security-operations-weekly-september-20-2026","status":"publish","type":"post","link":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5930","title":{"rendered":"Security Operations Weekly &mdash; September 20, 2026"},"content":{"rendered":"<style>\n.single .entry-title,\n.single .entry-header .entry-title,\n.single .post-title,\n.single header.entry-header h1,\n.single h1.entry-title,\n.single .page-title,\n.post-template-default h1.entry-title,\n.post-template-default .entry-header,\narticle .entry-header,\narticle .entry-title { display: none !important; }\n.single .entry-header { margin: 0 !important; padding: 0 !important; }\n.single .entry-content { margin-top: 0 !important; padding-top: 0 !important; }\n<\/style>\n<table role=\"presentation\" class=\"wrapper\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\">\n<tr>\n<td align=\"center\">\n<table role=\"presentation\" class=\"container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"680\">\n<p>        <!-- Banner --><\/p>\n<tr>\n<td class=\"banner\" style=\"background-color:#0f2c4d;background:linear-gradient(135deg,#0f2c4d 0%,#1e5a8f 50%,#2b8fb3 100%);padding:36px 32px;color:#ffffff;\">\n<p class=\"date\" style=\"color:#ffffff !important;\">September 20, 2026 &middot; Weekly Edition<\/p>\n<h1 style=\"color:#ffffff !important;\">Security Operations Weekly<\/h1>\n<p class=\"tagline\" style=\"color:#ffffff !important;\">Four vendors published four incompatible classes of security-AI evidence inside two weeks, and there is no common unit to put them on. SE Labs opens a rival test programme with five vendors signed up while MITRE ATT&amp;CK Evaluations participation falls from 30 to 11. CISA retires its weekly vulnerability bulletin on 28 September and moves coordinated disclosure onto VINCE-NT, both downstream of BOD 26-04&rsquo;s three-day KEV clock. NIST IR 8587 lands finalised, CISA publishes decoy guidance built on tooling you already own, and a fake LastPass authenticator repo ships a driver that terminates 145 AV and EDR processes.<\/p>\n<\/td>\n<\/tr>\n<p>        <!-- At a glance --><\/p>\n<tr>\n<td class=\"content\">\n<h2>This week at a glance<\/h2>\n<p>The measurement problem is the story this week, and it has three separate faces. VentureBeat&rsquo;s analysis is the sharpest: inside two weeks CrowdStrike, Google, Microsoft and Palo Alto Networks each published evidence for their security AI, and the four kinds of evidence do not share an axis. CrowdStrike published detection uplift and cost per task &mdash; 29% higher detection, 6x faster remediation, 99% lower cost, Red Tempest at $21 a task against $96 for a closed frontier model, Blue Solano at three cents a detection rule &mdash; and those cost figures are explicitly unaudited. Google published externally administered benchmarks: 86.2% on CyberGym and 47.2% pass@1 on CWE-Bench, run by Collinear. Microsoft published an actual randomised controlled trial, and the honest part of it is that 83% of the productivity gain came from queue reordering and auto-resolution rather than from the model&rsquo;s verdicts. Palo Alto published model-support breadth. Do not build a comparison table out of those four; the point is that one cannot be built. The second face is independent testing, where SE Labs launched PIVOT on 15 September from Wimbledon with Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos in the first cohort, Gartner and Forrester verifying the results, and nothing published until January 2027 &mdash; against a MITRE ATT&amp;CK Evaluations participation curve that has gone 30 vendors in 2023, 19 in 2024, 11 in 2025. The third face is the one you can act on immediately: UltraViolet Cyber&rsquo;s Equinox maps the SIEM and EDR detections you already run against ATT&amp;CK and ATLAS in under 30 minutes, and one trial customer moved from 26.6% measured coverage to 61.3%. Measure your own estate before you read anyone else&rsquo;s number.<\/p>\n<p>The second thread is procedural and has a date on it. CISA retires the weekly vulnerability bulletin on 28 September, justified by BOD 26-04, with KEV, alerts and advisories continuing &mdash; so any script, digest or ticket-creation job that consumes the weekly bulletin as a feed needs re-plumbing this week. Separately and unrelatedly, VINCE-NT went live on 17 September: CISA now sponsors, hosts and manages coordinated disclosure itself, replacing the arrangement where Carnegie Mellon&rsquo;s CERT\/CC hosted it from 2020. Active cases migrate over weeks, historical data stays in legacy VINCE, and terminology standardises on &ldquo;supplier&rdquo;, &ldquo;component&rdquo; and &ldquo;reporter&rdquo; with status fields aligned to CSAF and the CVE Record Format. Underneath both sits BOD 26-04, effective 10 June, which replaced BOD 22-01 with a three-day remediation deadline for publicly exposed KEV flaws carrying total control impact and 14 days for most other combinations &mdash; 67 of the 88 KEV entries added since then carry the three-day clock. The numbers that should worry you are the trend ones: full remediation fell to 26% for 2025 from 38%, median resolution rose to 43 days from 32, and roughly half the entries that later flipped to known-exploited did so more than a year after first appearing, with no alert on the flip.<\/p>\n<p>The rest is craft. NIST IR 8587 is finalised, not draft, and it is a detection document as much as an architecture one &mdash; it covers key protection, token lifetime and revocation, session management and logging, reuse of stolen tokens, and it extends to AI agents holding tokens and to post-quantum considerations for signing keys. Pair it with the OAuth consent-abuse piece, which is the most directly usable item in the issue: consent abuse survives MFA completely, because the victim authenticates correctly and then authorises a malicious application, so the detection has to sit on new app consents, new service principals, high-privilege scope grants and refresh-token use from unfamiliar infrastructure. CISA&rsquo;s decoy guidance is the week&rsquo;s best free deliverable: honeytokens, honeypots, breadcrumbs and tripwires built from the EDR, IAM and DLP you already license, with fake admin credentials and a bogus &ldquo;Project_Metrics.xlsx&rdquo; on an executive desktop as worked examples, and a reminder to keep the map of what is fake outside the production environment. DeepZero does the same job on the offensive side for free &mdash; a seven-stage YAML pipeline that parses PE headers, filters for IOCTL-exposing kernel drivers, excludes everything already on loldrivers.io, decompiles with Ghidra and scans with Semgrep. Which matters because the Rapuncel campaign is exactly the thing it hunts: a driver called Alinubx.sys masquerading as NVIDIA&rsquo;s nvfsflt64.sys that terminates 145 antivirus and EDR processes, bypasses Protected Process Light, and is not yet on Microsoft&rsquo;s vulnerable-driver blocklist. And on the recovery side, Zach Lewis&rsquo;s LockBit account supplies the lesson that only comes from having done it: LockBit claimed 200GB, the dump it actually posted was 2GB, four people were notified, and the negotiation existed to verify the claim and buy restore time &mdash; not to pay.<\/p>\n<p>            <!-- Watch list --><\/p>\n<div class=\"watchlist\">\n<h2>On our watch list<\/h2>\n<ul>\n<li><strong>The 28 September weekly-bulletin cutover, and what breaks quietly.<\/strong> CISA retires the weekly vulnerability bulletin on 2026-09-28; KEV, alerts and advisories continue. The failure mode is not loud &mdash; a parser that stops finding its source usually logs an error nobody reads. Between now and then, find every job, digest and ticket rule that consumes the weekly bulletin and confirm each one has a KEV or advisory source instead. Watch whether CISA publishes a machine-readable replacement for the roll-up itself, because nothing announced so far provides one.<\/li>\n<li><strong>Whether the three-day KEV clock survives contact with the 2027 numbers.<\/strong> BOD 26-04 has been in force since 2026-06-10, and 67 of the 88 KEV entries added since carry the three-day deadline. Against that, full remediation dropped to 26% for 2025 from 38% and median resolution rose to 43 days from 32. If the next measurement cycle does not show those two curves crossing, the directive will have tightened the deadline without moving the outcome &mdash; and that is the argument that will be made to your budget.<\/li>\n<li><strong>The first PIVOT results, due January 2027.<\/strong> SE Labs&rsquo; testing phase ends October 2026 and publication is January 2027, with Gartner and Forrester analysts verifying before release. Nothing can be said about how Broadcom, CrowdStrike, Fortinet, Palo Alto Networks or Sophos performed until then. The thing to watch in the meantime is whether the cohort grows for round two &mdash; and whether MITRE&rsquo;s advisory council, set up in February 2026, reverses the participation slide before PIVOT sets a new default.<\/li>\n<li><strong>Whether Alinubx.sys reaches Microsoft&rsquo;s vulnerable-driver blocklist.<\/strong> The driver shipped in the Rapuncel campaign terminates 145 antivirus and EDR processes and bypasses Protected Process Light, and it is not on the blocklist yet. Track the next blocklist revision. Until it lands, blocklist-only driver control does not cover this, and the compensating control is watching for driver loads that claim to be nvfsflt64.sys from a path or signer that does not match NVIDIA&rsquo;s.<\/li>\n<li><strong>Disclosures coming out of DeepZero.<\/strong> Rehman Ahmadzai reports multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus with some still in coordinated disclosure, and no CVEs are named yet. Because the tool excludes everything already catalogued on loldrivers.io by design, anything it publishes is by construction a driver your blocklist does not know about. Watch for the first CVEs, then check whether those drivers exist anywhere in your estate before the blocklist catches up.<\/li>\n<li><strong>The pre-patch window as a measured interval, not a worry.<\/strong> The Drupal case gives the first hard number: 51 minutes from patch publication to a functional exploit built with Claude Code, against an estimated couple of days for an unassisted expert. One data point is not a trend. Watch for the second and third published measurements of patch-to-exploit time, and in the meantime compare 51 minutes against your own median time from vendor advisory to change approval &mdash; that comparison is the whole argument.<\/li>\n<li><strong>Gartner&rsquo;s two predictions, pulling opposite ways.<\/strong> Craig Lawson argues the same AI tooling flooding 2026 with patches &mdash; Microsoft shipped over 970 in a single week in mid-September &mdash; will have cleaned enough legacy code to lower severity by 2027. Elsewhere Gartner predicts more than 40% of agentic AI projects will be cancelled by the end of 2027. Both are forecasts from the same house, neither is data, and the second is the one to hold vendors to when they quote the first.<\/li>\n<li><strong>Whether anyone publishes AI SOC evidence that is not vendor-supplied.<\/strong> KuppingerCole was tracking 39 AI SOC vendors as of April 2026, with 84 further candidates identified beyond that. The demand-side numbers come from Microsoft and Omdia: 66% of SOCs lose 20% of weekly time to data aggregation and 42% of alerts go uninvestigated. What does not exist is an independent measurement of what an AI SOC agent does to those two figures in production. Watch for the first one, from anyone without a product to sell.<\/li>\n<li><strong>The consent-grant telemetry you may not be collecting.<\/strong> OAuth consent abuse defeats MFA by design, and the detection surface is new application consents, new service principals, high-privilege scope approvals and refresh-token activity from unfamiliar infrastructure. Before the next campaign, check whether those events actually reach your SIEM with enough retention to hunt on, and whether any alert fires on them today. Most estates discover the gap during the incident.<\/li>\n<li><strong>November 2026, for the Teams file-extension control.<\/strong> Microsoft 365 roadmap item 571298 is in development with GA targeted for November 2026 across Android, desktop, iOS, macOS and web in multi-tenant cloud. Today admins cannot modify the blocked-file-type list at all. Watch the roadmap item rather than the headline, and do not write a policy that depends on the control until it ships.<\/li>\n<li><strong>Whether the MSP compliance gap closes or gets sold.<\/strong> Sophos&rsquo; survey of 800 MSPs found 46% of customers rely on their MSP for CISO services, only 6% of MSPs deliver all seven compliance services, and 88% use software for compliance work while only 33% fully automate security posture reporting. If you buy security from an MSP, that is a question for your next review. Watch whether the automation figure moves before the CISO-services figure does.<\/li>\n<\/ul><\/div>\n<p>            <!-- Topic map --><\/p>\n<div class=\"topic-map\">\n              <img decoding=\"async\" src=\"https:\/\/www.cybersecurityinstitute.com\/blog\/wp-content\/uploads\/2026\/09\/topic-map-security-operations-2026-09-20.png\" alt=\"Topic map of this week's Security Operations Weekly themes\" loading=\"eager\"><\/p>\n<p class=\"caption\">This week&rsquo;s topic map &mdash; the detection-measurement cluster (the four incompatible vendor evidence classes behind CrowdStrike SafeMind, Gemini 3.8 Flash Cyber and Security Copilot, SE Labs PIVOT against MITRE ATT&amp;CK Evaluations, and UltraViolet Equinox mapping coverage to ATT&amp;CK and ATLAS), CISA&rsquo;s vulnerability-handling rewire (KEV, BOD 26-04, VINCE-NT and the pre-patch window), identity and tokens as the detection surface (NIST IR 8587, OAuth consent abuse, hiring fraud), deception and adversary-facing validation (CISA&rsquo;s decoy guidance, DeepZero and BYOVD, Tuskira Vector), and the response cluster where LockBit recovery practice meets Rapuncel&rsquo;s EDR-killing driver.<\/p>\n<p>              <!-- INTERACTIVE_MAP_LINK_START --><\/p>\n<p style=\"margin:10px 0 0;text-align:center;\"><a href=\"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5929\" target=\"_blank\" rel=\"noopener\" style=\"display:inline-block;padding:8px 18px;background-color:#0f172a;color:#ffffff !important;text-decoration:none;border-radius:6px;font-size:13px;font-weight:600;\">View interactive topic map &rarr;<\/a><\/p>\n<p><!-- INTERACTIVE_MAP_LINK_END -->\n            <\/div>\n<p>            <!-- Article index --><\/p>\n<h2>Article index<\/h2>\n<h4>Measuring what the SOC actually detects<\/h4>\n<div class=\"cluster-intro\">The industry lost its common yardstick in the same fortnight it most needed one. Four vendors published four incompatible classes of evidence, a UK lab opened a rival test programme as MITRE&rsquo;s evaluation participation fell by two-thirds in two years, and one product now measures your existing detection coverage against ATT&amp;CK in half an hour. Note that every performance figure in the first row is vendor-published; only Google&rsquo;s benchmarks and Microsoft&rsquo;s trial had third-party administration.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>1. <a href=\"https:\/\/venturebeat.com\/security\/nobody-can-compare-the-security-ai-numbers-crowdstrike-google-palo-alto-and-microsoft-published-including-the-cisos-who-are-stuck-with-the-results\">Nobody can compare the security-AI numbers CrowdStrike, Google, Palo Alto and Microsoft published<\/a><\/td>\n<td class=\"src\">VentureBeat<\/td>\n<td class=\"dt\">Sep 15, 2026<\/td>\n<\/tr>\n<tr>\n<td>2. <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/cyber-vendors-mitre-uk-testing\/\">Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes<\/a><\/td>\n<td class=\"src\">Infosecurity Magazine<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>3. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/15\/ultraviolet-cyber-equinox\/\">UltraViolet Cyber Equinox measures detection coverage against MITRE frameworks<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 15, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>CISA rewires vulnerability handling &mdash; and the pre-patch window<\/h4>\n<div class=\"cluster-intro\">Two separate CISA announcements in the same week, both downstream of BOD 26-04, plus the triage method and the timing problem underneath them. The bulletin retirement and VINCE-NT are unrelated in substance &mdash; the SecurityWeek piece does not mention VINCE at all &mdash; but they land on the same teams in the same week. Three of these five are vendor-contributed perspectives, bylined in each write-up below.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>4. <a href=\"https:\/\/www.securityweek.com\/cisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot\/\">CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Sep 17, 2026<\/td>\n<\/tr>\n<tr>\n<td>5. <a href=\"https:\/\/www.scworld.com\/news\/new-cisa-hosted-vince-nt-system-revealed-for-coordinated-vulnerability-disclosure\">New CISA-hosted VINCE-NT system revealed for coordinated vulnerability disclosure<\/a><\/td>\n<td class=\"src\">SC Media<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>6. <a href=\"https:\/\/www.scworld.com\/perspective\/how-teams-can-patch-faster-when-a-bug-gets-added-to-cisas-kev\">How teams can patch faster when a bug gets added to CISA&rsquo;s KEV<\/a><\/td>\n<td class=\"src\">SC Media<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>7. <a href=\"https:\/\/www.scworld.com\/perspective\/in-the-ai-era-the-pre-patch-window-needs-its-own-security-playbook\">In the AI era, the pre-patch window needs its own security playbook<\/a><\/td>\n<td class=\"src\">SC Media<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>8. <a href=\"https:\/\/www.theregister.com\/security\/2026\/09\/16\/mythos_has_made_2026_patching_hell_it_might_make_2027_a_breeze\/5296747\">Mythos has made 2026 patching hell. It might make 2027 a breeze<\/a><\/td>\n<td class=\"src\">The Register<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Identity and tokens as the detection surface<\/h4>\n<div class=\"cluster-intro\">A finalised NIST playbook on protecting the things that carry authentication, and three stories about what happens when they are abused rather than stolen. The OAuth row is the most immediately usable: it describes an attack that MFA does not touch, and names the events you need to be logging before it happens to you.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>9. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/16\/nist-cisa-cloud-token-security-guidance\/\">NIST and CISA finalize playbook to stop token theft and forgery<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>10. <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/mfa-oauth-consent-abuse\">MFA Won&rsquo;t Save You From OAuth Consent Abuse<\/a><\/td>\n<td class=\"src\">Dark Reading<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>11. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/18\/hypr-hiring-fraud-detection-report\/\">98% of fraudulent hires have company credentials by the time they&rsquo;re caught<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>12. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/17\/druva-identity-resilience-ransomware-detection\/\">Druva expands identity resilience with ransomware detection<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 17, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Deception and adversary-facing validation<\/h4>\n<div class=\"cluster-intro\">Three ways to generate your own ground truth instead of waiting for an alert, at three different budgets: free government guidance that runs on tooling you already license, a free open-source driver-hunting pipeline, and a commercial autonomous red-teaming platform. The first two are the week&rsquo;s best value.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>13. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/17\/cisa-guidance-for-implementing-cyber-decoys\/\">CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 17, 2026<\/td>\n<\/tr>\n<tr>\n<td>14. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/16\/vulnerable-windows-drivers-deepzero-open-source\/\">DeepZero: Open-source hunting for vulnerable Windows drivers<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>15. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/17\/tuskira-vector-autonomous-red-teaming\/\">Tuskira Vector brings autonomous red teaming to attack surface validation<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 17, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Incident response and recovery practice<\/h4>\n<div class=\"cluster-intro\">Both rows arrived here by reroute this week and both are written for the responder. The LockBit interview is the rarest kind of source &mdash; a named CISO describing the sequence he actually ran, including the parts that were uncomfortable. The Rapuncel report earns its place on defence evasion rather than on the stealer&rsquo;s feature list.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>16. <a href=\"https:\/\/www.infosecurity-magazine.com\/interviews\/ciso-zach-lewis-ransomware\/\">A CISO&rsquo;s Lessons in Ransomware Response and Recovery After a Real-World LockBit Attack<\/a><\/td>\n<td class=\"src\">Infosecurity Magazine<\/td>\n<td class=\"dt\">Sep 14, 2026<\/td>\n<\/tr>\n<tr>\n<td>17. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer\/\">New Rapuncel Infostealer Pushed via Fake LastPass Authenticator GitHub Repos<\/a><\/td>\n<td class=\"src\">BleepingComputer<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Where the enthusiasm outruns the evidence<\/h4>\n<div class=\"cluster-intro\">Two arguments about deploying agents into the SOC, from opposite starting points and landing in the same place. Every statistic in the first is borrowed from a third party; the second is written by a vendor CTO and its headline contrast comes from that vendor&rsquo;s own report. Read both as hypotheses to test, not as measurements.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>18. <a href=\"https:\/\/securityboulevard.com\/2026\/09\/ai-soc-vs-soar-augmentation-or-replacement\/\">AI SOC vs. SOAR: Augmentation or Replacement?<\/a><\/td>\n<td class=\"src\">Security Boulevard<\/td>\n<td class=\"dt\">Sep 14, 2026<\/td>\n<\/tr>\n<tr>\n<td>19. <a href=\"https:\/\/www.scworld.com\/perspective\/hastily-deployed-agentic-security-is-not-the-answer-to-enterprise-cyber-threats\">Hastily deployed agentic security is not the answer to enterprise cyber threats<\/a><\/td>\n<td class=\"src\">SC Media<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>Platform and endpoint hygiene the SOC absorbs<\/h4>\n<div class=\"cluster-intro\">The unglamorous queue. One of these lets you close tickets today, one is a control that does not exist yet despite the headline, and one is a survey whose headline number is not what it appears to be &mdash; the $250,000 is a self-reported per-incident maximum that nearly one in four respondents exceeded, not an average.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>20. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-fixes-bug-behind-defender-antivirus-is-turned-off-alerts\/\">Microsoft fixes bug behind &lsquo;Defender Antivirus is turned off&rsquo; alerts<\/a><\/td>\n<td class=\"src\">BleepingComputer<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>21. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-teams-will-let-admins-block-custom-file-extensions\/\">Microsoft Teams will let admins block custom file extensions<\/a><\/td>\n<td class=\"src\">BleepingComputer<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>22. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/14\/digicert-certificate-management-automation-report\/\">Certificate failures can cost firms over $250,000<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 14, 2026<\/td>\n<\/tr>\n<\/table>\n<h4>MDR, MSSP and the analyst market<\/h4>\n<div class=\"cluster-intro\">Who runs the SOC when it is not you, what the category is raising, and the state of the job market for the people in it. The Sophos survey is the only row here with real data behind it; the funding round is the datapoint; the careers interview is included as a careers interview, not as SOC craft.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>23. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/16\/msp-ciso-services-compliance\/\">MSPs say nearly half their customers rely on them for CISO services<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<tr>\n<td>24. <a href=\"https:\/\/www.securityweek.com\/mind-secures-72-million-for-ai-powered-dlp\/\">MIND Secures $72 Million for AI-Powered DLP<\/a><\/td>\n<td class=\"src\">SecurityWeek<\/td>\n<td class=\"dt\">Sep 18, 2026<\/td>\n<\/tr>\n<tr>\n<td>25. <a href=\"https:\/\/www.darkreading.com\/cybersecurity-careers\/finding-hope-brutal-job-market\">Fighting Your Dragons Through Tough Tech Times<\/a><\/td>\n<td class=\"src\">Dark Reading<\/td>\n<td class=\"dt\">Sep 16, 2026<\/td>\n<\/tr>\n<\/table>\n<p>            <!-- Detailed write-ups --><\/p>\n<h2>Detailed write-ups<\/h2>\n<div class=\"article\">\n<h4>1. Four vendors, four kinds of evidence, no common axis<\/h4>\n<p class=\"meta\">VentureBeat &middot; September 15, 2026<\/p>\n<p>Inside two weeks, CrowdStrike, Google, Microsoft and Palo Alto Networks each published proof that their security AI works. The problem is that they published four different classes of proof. CrowdStrike published detection uplift and cost per task for SafeMind, launched 2026-09-01: 29% higher detection than rival models, 6x faster remediation, 99% lower cost, with its offensive model Red Tempest costed at $21 per task against $96 for a closed frontier model and $62 for an open one, and its defensive model Blue Solano at three cents per detection rule against $10 off-the-shelf. Those cost figures have not been independently audited. Google published external benchmark scores for Gemini 3.8 Flash Cyber, launched 2026-09-02: 86.2% on the CyberGym vulnerability-discovery benchmark, 47.2% pass@1 on CWE-Bench patching, and 2.6x more correct patches to Chrome vulnerabilities than larger commercial models &mdash; administered externally by Collinear, which is the strongest provenance in the set. Microsoft published a randomised controlled trial for Security Copilot: analysts identified up to 6.5x more true positives per minute with a 77% improved verdict F1 score. Palo Alto published model-support breadth. There is no unit that converts a cost per detection rule into a benchmark pass rate into an F1 improvement.<\/p>\n<p>The most useful number in the piece is the one that undercuts the headline it sits under. Of Microsoft&rsquo;s measured productivity gain, 83% came from queue reordering and auto-resolution rather than from the quality of the model&rsquo;s verdicts. That is a finding about workflow, not about intelligence, and it is reproducible in your own SOC without buying anything: if most of the gain is in what reaches the analyst and in what closes without reaching them, then triage sequencing and auto-close rules are the lever, and they are levers you already own. It also reframes what to ask a vendor in a bake-off &mdash; not &ldquo;how accurate is the model&rdquo; but &ldquo;how much of your published gain survives if we hold queue management constant.&rdquo;<\/p>\n<p>Two context numbers are worth carrying. Amazon&rsquo;s MadPot honeypot network captured an AI agent completing a full attack chain in 12 minutes 42 seconds across 94 events with zero syntax errors, and CrowdStrike separately reported an 89% year-over-year rise in AI-enabled attacks. Against that, CrowdStrike says SafeMind&rsquo;s training corpus contains 3.1 million working hours of expertise drawn from its Falcon Complete MDR engineers &mdash; a claim about data provenance, which is a fifth incommensurable category. Kayne McGladrey, IEEE Senior Member and independent vCISO, supplies the line that explains why the field looks like this: &ldquo;The barrier to entry is normalized, labeled data and funding allocation, not some magical capability gap.&rdquo; A VentureBeat pulse survey of 116 enterprises in July found 92 of the 93 running or piloting agents named their primary security layer, with CrowdStrike in 7% of stacks and Palo Alto Networks in 6% &mdash; which tells you this market is still being decided. Do not build a comparison table out of these four vendors. The absence of one is the finding.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/venturebeat.com\/security\/nobody-can-compare-the-security-ai-numbers-crowdstrike-google-palo-alto-and-microsoft-published-including-the-cisos-who-are-stuck-with-the-results\">VentureBeat (nobody can compare the security-AI numbers the four vendors published)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>2. A new test lab opens as MITRE&rsquo;s evaluation cohort shrinks by two-thirds<\/h4>\n<p class=\"meta\">Infosecurity Magazine &middot; September 16, 2026<\/p>\n<p>SE Labs, a UK testing and advisory provider, launched a programme called PIVOT on 2026-09-15, run from its laboratory in Wimbledon, London. Five vendors are in the first cohort: Broadcom (parent of Symantec and Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks and Sophos. The method is full-chain adversary emulation rather than component testing &mdash; ethical hackers impersonating nation-state groups and criminal actors, replicating ransomware, malware and phishing across complete attack chains, assessing where protection holds or fails and whether an attacker can escalate privileges or move laterally. Results will be independently verified by Gartner and Forrester analysts before publication. The programme runs six months: testing ends October 2026 and results are due January 2027. Nothing can be said yet about how any of the five performed, and any vendor claiming otherwise before January is claiming something that does not exist.<\/p>\n<p>The context is a participation curve. MITRE ATT&amp;CK Evaluations drew 30 participants in 2023, 19 vendors in 2024 and 11 in 2025; Microsoft, SentinelOne and Palo Alto Networks were among those that withdrew for the 2025 round. MITRE established an advisory council in February 2026 to address the evaluations&rsquo; long-term sustainability. Read that precisely: the evaluations have not been paused, cancelled or made paid. What has happened is that fewer vendors show up, and a commercial alternative has now opened with a verification arrangement the incumbent does not have. Charles Clancy, MITRE&rsquo;s CTO and SVP, is candid about the cause: &ldquo;Each year we want to design a test harder than before&#8230; sometimes we don&rsquo;t get the balance quite right.&rdquo; Note also that Palo Alto Networks appears on both sides &mdash; it withdrew from MITRE&rsquo;s 2025 round and has joined PIVOT.<\/p>\n<p>For a SOC, the practical consequence arrives before January 2027. If your product-selection criteria or your board reporting cite MITRE evaluation results, check which round they come from and how many vendors were in it, because a 2025 result drawn from an 11-vendor field is a different claim from a 2023 result drawn from 30. And there is a version of this question you can answer internally right now. UltraViolet Cyber&rsquo;s Equinox, announced the day before PIVOT, maps the detections already running in your SIEM and EDR against MITRE ATT&amp;CK and MITRE ATLAS and returns a coverage figure in under 30 minutes; one trial customer&rsquo;s measured coverage moved from 26.6% to 61.3% once they could see the gaps. Whatever any lab publishes about a product in general, the number that governs your alerts is the coverage of the rules you actually have deployed.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/cyber-vendors-mitre-uk-testing\/\">Infosecurity Magazine (SE Labs PIVOT and the MITRE evaluations)<\/a> &middot; <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/15\/ultraviolet-cyber-equinox\/\">Help Net Security (UltraViolet Cyber Equinox detection-coverage measurement)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>3. Two CISA changes in one week, and the triage funnel underneath them<\/h4>\n<p class=\"meta\">SecurityWeek &middot; SC Media &middot; September 17&ndash;18, 2026<\/p>\n<p>These are two separate announcements, and it is worth being clear about that because they arrived together. First: CISA retires its weekly vulnerability bulletin, effective 2026-09-28, justified by BOD 26-04&rsquo;s shift from severity scores to real-world risk. KEV, alerts and advisories continue. If any part of your process consumes the weekly bulletin as a feed &mdash; a scraper, a digest that goes to an engineering distribution list, a job that opens tickets from it &mdash; it has eight days to be re-pointed, and the failure mode is silent. Second, and unrelated: VINCE-NT went live on 2026-09-17 and was announced on 2026-09-18. CISA now fully sponsors, hosts and manages the coordinated vulnerability disclosure system, replacing the arrangement in place since 2020 where CISA sponsored VINCE but Carnegie Mellon&rsquo;s CERT\/CC hosted it. Active cases migrate over the coming weeks and historical data stays in legacy VINCE. Terminology standardises on &ldquo;supplier&rdquo;, &ldquo;component&rdquo; and &ldquo;reporter&rdquo;, and status fields align to CSAF and the CVE Record Format &mdash; which matters if you have automation parsing disclosure records, and which is a genuine improvement for anyone who has tried to reconcile them by hand.<\/p>\n<p>The directive underneath both is BOD 26-04, effective 2026-06-10, which replaced BOD 22-01. It sets a three-day remediation deadline for publicly exposed KEV flaws with total control impact and 14 days for most other combinations. Of the 88 KEV entries added since it took effect, 67 carry the three-day deadline &mdash; so the tight clock is the normal case, not the exception. For scale: the KEV catalogue held 1,705 entries as of 2026-09-10 across 283 vendors, with 221 added during 2026 through 11 September, roughly six per week. BOD 26-04 binds federal civilian agencies and is not a legal obligation for a private-sector SOC, but it is the best-specified public triage template available, which is how the SC Media piece uses it.<\/p>\n<p>That piece &mdash; written by Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, so read the framing accordingly &mdash; prescribes a four-step funnel that survives its vendor byline because the inputs are checkable against CISA&rsquo;s own catalogue. Filter first by inventory presence, matching KEV products against assets you actually own, which usually removes most of the list. Sort what remains using the BOD 26-04 decision inputs: exposure, KEV status, automation, impact. Treat the top tier as an investigation with forensic triage rather than as a patch ticket &mdash; a publicly exposed asset with a known-exploited flaw and total control impact should be assumed reached until shown otherwise. Then use exploitation recency to order the rest. The numbers arguing for a method are grim: full remediation fell to 26% for 2025 from 38%, median resolution rose to 43 days from 32, and the best-performing teams close only 30&ndash;40% of instances in the first week. And the finding that should change your process rather than your queue: roughly half the entries that later flipped to known-exploited did so more than a year after first appearing, and none of those flips carried an alert. &ldquo;Roughly half of those flips landed more than a year after the entry appeared; none carried an alert,&rdquo; Hogue-Spears writes. A one-time triage at disclosure is therefore structurally insufficient &mdash; you need a re-evaluation pass, and you need to confirm your KEV tooling alerts on updates to existing entries, not only on new ones.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.securityweek.com\/cisa-retires-weekly-vulnerability-bulletin-in-risk-based-pivot\/\">SecurityWeek (CISA retires the weekly vulnerability bulletin)<\/a> &middot; <a href=\"https:\/\/www.scworld.com\/news\/new-cisa-hosted-vince-nt-system-revealed-for-coordinated-vulnerability-disclosure\">SC Media (CISA-hosted VINCE-NT for coordinated disclosure)<\/a> &middot; <a href=\"https:\/\/www.scworld.com\/perspective\/how-teams-can-patch-faster-when-a-bug-gets-added-to-cisas-kev\">SC Media (patching faster on a KEV addition &mdash; Black Duck perspective)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>4. Fifty-one minutes from patch to exploit, and 970 patches in a week<\/h4>\n<p class=\"meta\">SC Media &middot; The Register &middot; September 16, 2026<\/p>\n<p>The pre-patch window has a measured length now. Itai Goldman, co-founder and CTO of Miggo Security, reports that a functional exploit for Drupal CVE-2026-9082 was built with Claude Code in 51 minutes from patch publication, against an estimated couple of days for an unassisted expert. Treat that as one data point rather than a trend &mdash; it is a single case, published by a vendor whose product category benefits from the conclusion. But it is a data point with a specific and useful shape, because the interval it measures is the one your change process has to beat. The argument is that the window between a patch becoming public and your estate having it applied is now its own security problem with its own playbook, rather than a scheduling inconvenience: once a patch ships, the diff is public, and the diff is an exploitation specification that automated tooling can now read quickly. The practical translation is that virtual patching, WAF rules and compensating controls at the exposure layer stop being a fallback for when you cannot patch and become the thing that covers the window while you do.<\/p>\n<p>The Register supplies the volume half of the problem. Anthropic&rsquo;s AI bug-hunting tool Mythos is generating findings at a rate that has already changed the downstream shape of the year: Microsoft shipped over 970 patches in a single week in mid-September 2026. The forward-looking half of that story&rsquo;s headline &mdash; that 2027 will be easier &mdash; rests entirely on a prediction by Craig Lawson, research vice president at Gartner, that the same tooling will have cleaned enough legacy code by then to lower overall severity. That is a forecast, not data, and it is worth naming as such before it appears in anyone&rsquo;s budget justification. It is also in some tension with the other Gartner prediction circulating this week, that more than 40% of agentic AI projects will be cancelled by the end of 2027.<\/p>\n<p>Put the two halves together and the operational question is not &ldquo;are we patching fast enough&rdquo; but &ldquo;what covers us during the interval we cannot compress.&rdquo; If 51 minutes is even roughly representative of what automated exploit development can do against a public diff, then no change-approval cycle wins that race, and the only controls that matter in the window are the ones that do not require touching the vulnerable code. Measure your own median time from vendor advisory to production patch for one class of internet-facing asset, and set it next to 51 minutes. That comparison is the argument for funding exposure-layer controls, and it costs an afternoon of query-writing to produce.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.scworld.com\/perspective\/in-the-ai-era-the-pre-patch-window-needs-its-own-security-playbook\">SC Media (the pre-patch window needs its own playbook &mdash; Miggo Security perspective)<\/a> &middot; <a href=\"https:\/\/www.theregister.com\/security\/2026\/09\/16\/mythos_has_made_2026_patching_hell_it_might_make_2027_a_breeze\/5296747\">The Register (Mythos, 2026 patch volume and Gartner&rsquo;s 2027 prediction)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>5. NIST IR 8587 lands finalised &mdash; and the consent attack MFA does not touch<\/h4>\n<p class=\"meta\">Help Net Security &middot; Dark Reading &middot; September 16&ndash;18, 2026<\/p>\n<p>NIST IR 8587, <em>Protecting Tokens and Assertions from Forgery, Theft, and Misuse<\/em>, was published on 2026-09-16 as a finalised joint NIST and CISA publication &mdash; not a draft, so there is no comment window to wait for. Its scope is digitally signed assertions and tokens based on asymmetric cryptography, as used in single sign-on, identity federation, API access and workload access for applications and automated services. The recommendations centre on key management, token verification and token lifecycle control: protecting the cryptographic keys that sign tokens and assertions, managing token lifetimes and revocation procedures, and session management and logging practice. Two things make it more than an architecture document for a SOC. First, it addresses detection and response directly &mdash; protecting against reuse of stolen tokens, and monitoring for the suspicious activity that indicates credential theft. Second, it extends to AI agents as token holders and to post-quantum considerations for the signing keys, which is the first time most teams will see those two problems treated in the same guidance. Ryan Galluzzo, NIST&rsquo;s Digital Identity Program Lead: &ldquo;This publication provides implementation considerations for protecting tokens appropriately.&rdquo; One caveat on scoping: the published summary does not name specific protocols, so do not attribute OAuth-, SAML- or OIDC-specific guidance to IR 8587 without reading the document itself.<\/p>\n<p>The Dark Reading piece on OAuth consent abuse is the independent companion, and it is the most directly actionable item in this issue. Consent abuse defeats multi-factor authentication completely, and it does so without breaking it: the victim authenticates successfully, passes MFA, and then authorises a malicious application. Every authentication control did its job. What the attacker walks away with is a grant &mdash; a token relationship that persists, that no password reset invalidates, and that looks like a legitimate integration in every log that records only sign-ins. That is why the detection has to sit somewhere else entirely: on new application consents, on newly created service principals, on approvals of high-privilege scopes, and on refresh-token activity originating from infrastructure you do not recognise.<\/p>\n<p>Those four are a concrete hunting list, and the first question is not whether you alert on them but whether you are collecting them at all with enough retention to look backwards. In most estates the consent-grant and service-principal creation events exist but are not routed to the SIEM, and the gap is discovered during the incident rather than before it. Pair that check with IR 8587&rsquo;s revocation guidance, because the response to a consent-abuse finding is revoking the grant and the refresh tokens, not rotating the user&rsquo;s password &mdash; and if your IR playbook for &ldquo;account compromise&rdquo; says password reset and MFA re-enrolment, it does not cover this case.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/16\/nist-cisa-cloud-token-security-guidance\/\">Help Net Security (NIST IR 8587 on token theft and forgery)<\/a> &middot; <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/mfa-oauth-consent-abuse\">Dark Reading (MFA won&rsquo;t save you from OAuth consent abuse)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>6. CISA&rsquo;s decoy guidance: deception built from tooling you already license<\/h4>\n<p class=\"meta\">Help Net Security &middot; September 17, 2026<\/p>\n<p>CISA published <em>Using Cyber Decoys to Strengthen Detection and Response<\/em> in September 2026, aimed explicitly at critical infrastructure organisations, smaller security teams with limited resources, and SMBs. It covers four decoy classes and the distinction between them is operationally useful: honeytokens (files, records, secrets and credentials), honeypots (systems and services), breadcrumbs (artefacts that steer an intruder toward a decoy) and tripwires (alarmed decoys). The central argument, and the reason this is the week&rsquo;s best free deliverable, is that you do not need to buy a deception platform. EDR platforms, identity and access management systems and DLP tooling can all carry decoy detection, which means the cost of starting is configuration time rather than procurement.<\/p>\n<p>The worked examples are deliberately unglamorous: fake administrator credentials, decoy folders on executive desktops, and bogus files with plausible names such as &ldquo;Project_Metrics.xlsx&rdquo;, with alerting on PowerShell execution where it is not authorised. That last pairing is the pattern to copy &mdash; a decoy is only as good as the alert attached to it, and an unmonitored honeytoken is just a file. The guidance directs teams to map coverage gaps using MITRE ATT&amp;CK and references MITRE Engage for deception planning, which gives you a way to choose which techniques to place decoys against rather than scattering them.<\/p>\n<p>The single most important instruction in the document is the one about documentation: store the record of what is fake outside the production environment. An intruder who reaches your file shares should not be able to read the map that tells them which credentials are bait. It is also the instruction most likely to be skipped, because the natural home for that spreadsheet is the same SharePoint as everything else. Chris Butera, CISA&rsquo;s Acting Executive Assistant Director for Cybersecurity: &ldquo;CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy.&rdquo; Note for accuracy when you circulate it internally &mdash; this is CISA guidance, not a co-sealed international joint advisory.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/17\/cisa-guidance-for-implementing-cyber-decoys\/\">Help Net Security (CISA guidance on implementing cyber decoys)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>7. DeepZero hunts the drivers that are not on the blocklist yet<\/h4>\n<p class=\"meta\">Help Net Security &middot; September 16, 2026<\/p>\n<p>DeepZero is an open-source automated scanning engine for exploitable Windows kernel drivers, created and maintained by Rehman Ahmadzai and published at github.com\/416rehman\/DeepZero. It is written for Python 3.11 and above, with scanning pipelines defined in YAML. The pipeline runs seven stages: PE header parsing; filtering for kernel-mode drivers that expose IOCTL surfaces; exclusion of drivers already catalogued on loldrivers.io; Ghidra headless decompilation; Semgrep rule scanning of the exported C source; a candidate-reduction step; and an AI language-model exploitability assessment. The target is BYOVD &mdash; Bring Your Own Vulnerable Driver &mdash; where an attacker loads a legitimately signed driver that carries an exploitable flaw in order to disable endpoint protection from kernel space.<\/p>\n<p>The design decision that matters is the third stage. Excluding everything already on loldrivers.io means DeepZero is built to surface drivers that are <em>not<\/em> on the public blocklist, rather than to re-find known ones. That inverts the usual relationship between a tool and a blocklist, and it is the reason this belongs in a SOC bulletin rather than a research one: your driver-blocking policy, whether it is Microsoft&rsquo;s vulnerable-driver blocklist or a WDAC policy of your own, is by definition a list of what has already been found. Ahmadzai reports multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still going through coordinated disclosure &mdash; &ldquo;found multiple verified vulnerabilities in a subset of the Snappy Driver Installer corpus, with some still undergoing the disclosure process.&rdquo; No CVEs are named and no count of confirmed findings is available, so do not repeat this as a number.<\/p>\n<p>Two practical uses. If you maintain an allowlist or a WDAC policy, DeepZero gives you a way to test your own driver corpus against the same criteria an attacker would use, rather than waiting for a blocklist update. And if you run a detection engineering function, the IOCTL-surface filter in stage two is a reasonable starting definition for what a &ldquo;driver worth watching&rdquo; looks like in your own telemetry. The urgency is supplied elsewhere in this issue: the Rapuncel campaign is shipping exactly this class of component right now, and it is not on Microsoft&rsquo;s blocklist.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/09\/16\/vulnerable-windows-drivers-deepzero-open-source\/\">Help Net Security (DeepZero open-source vulnerable-driver hunting)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>8. LockBit, 4:30 AM: the response sequence from someone who ran it<\/h4>\n<p class=\"meta\">Infosecurity Magazine &middot; September 14, 2026<\/p>\n<p>Zach Lewis is CISO at the University of Health Science and Pharmacy in St. Louis, and the LockBit attack he describes happened in summer 2023. The detail responders should sit with is how it began. It opened as an outage call at roughly 4:30 AM. The attackers were already inside and stayed undetected through that first outage, triggering encryption only during a second environment failure a couple of days later. Which means the first event &mdash; the one that looked like an infrastructure problem and was almost certainly handled by an infrastructure team &mdash; was the intrusion, and the organisation had a window it did not know it had. If your escalation path routes an unexplained early-morning outage to operations without a security look, this is the case that argues for changing it.<\/p>\n<p>The response sequence is worth copying in order: contact the cyber insurer immediately, notify the FBI and law enforcement, then open negotiations with the threat actor &mdash; explicitly to verify the attacker&rsquo;s claims and to buy recovery time, not to pay. Recovery ran off offline backups, and once essential systems were restored the university declined the ransom demand. That sequencing is the operational teaching: negotiation was an intelligence and time-buying activity conducted in parallel with restoration, with the decision about payment deferred until restoration had actually proved itself.<\/p>\n<p>The verification payoff is stark. LockBit claimed 200GB of stolen data. The dump the group actually posted was 2GB, and four individuals were ultimately notified of data exposure. The claim was inflated by two orders of magnitude, and the only way to know that was to engage long enough to test it. Report that carefully inside your own organisation &mdash; 200GB was the claim, not the volume stolen &mdash; because the gap between the two is precisely the reason to verify before letting an attacker&rsquo;s number drive your notification and disclosure posture. Afterwards, UHSP migrated nearly all applications and infrastructure to cloud and SaaS platforms, cut on-site data storage, and deployed the Island enterprise browser to centralise identity and access control. Lewis on what the morning felt like: &ldquo;You know it&rsquo;s a make or break moment for your career. It&rsquo;s one of the worst feelings in cybersecurity.&rdquo;<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.infosecurity-magazine.com\/interviews\/ciso-zach-lewis-ransomware\/\">Infosecurity Magazine (a CISO&rsquo;s lessons in ransomware response and recovery after LockBit)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>9. Rapuncel: a fake authenticator repo that ships a driver killing 145 security processes<\/h4>\n<p class=\"meta\">BleepingComputer &middot; September 18, 2026<\/p>\n<p>The lure is a supply-chain social-engineering play: more than 40 fake GitHub repositories impersonating LastPass and 39 other companies, offering what looks like a LastPass authenticator. It was discovered by LastPass and Delphos Labs. But the reason this story is in a SOC bulletin rather than a malware one is the defence-evasion chain, which is aimed directly at you. The package ships a kernel driver named Alinubx.sys that masquerades as NVIDIA&rsquo;s nvfsflt64.sys. Loaded, it terminates 145 antivirus and EDR processes and bypasses Protected Process Light &mdash; the mechanism specifically meant to stop user-mode code from killing security agents. And it is not yet on Microsoft&rsquo;s vulnerable-driver blocklist, which means blocklist-based driver control does not cover it today.<\/p>\n<p>The rest of the chain has detection value too. Archives are inflated to 148MB to evade scanning, so a size-based scan exclusion is an exploitable gap rather than a performance tweak &mdash; check what your endpoint and mail scanners skip above. Execution uses DLL sideloading via a renamed legitimate Microsoft Visual Studio CoreCLR debugger, vsdbg.exe, so the parent process in your telemetry will be a signed Microsoft binary under a name it does not normally carry. Command and control is at 2.26.126[.]50. The stealer itself is assessed with moderate confidence as a BoryptGrab variant packed with the Cruciferra PUROSANGUE crypter &mdash; note the confidence level before you pivot your whole hunt on the family attribution.<\/p>\n<p>Three hunts come straight out of this, and all three outlive this campaign. Look for driver loads claiming to be nvfsflt64.sys from a path or signer that does not match NVIDIA&rsquo;s, since the impersonation is the detectable part and the filename is not. Look for vsdbg.exe running under a non-standard name or from a non-standard path, and for sideloaded DLL loads beneath it. And look for the negative signal that this whole chain is designed to produce: EDR or AV agents stopping, in bulk, on a host that stays up. An endpoint that goes quiet is an alert, not an absence of one. That is the same BYOVD problem DeepZero exists to find, arriving from the other direction in the same week.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer\/\">BleepingComputer (fake LastPass authenticator GitHub repos push the Rapuncel infostealer)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>10. AI SOC against SOAR, and the case for going slower<\/h4>\n<p class=\"meta\">Security Boulevard &middot; SC Media &middot; September 14&ndash;16, 2026<\/p>\n<p>The clearest thing in Kirsten Doyle&rsquo;s piece is the structural distinction, and it is worth keeping because most vendor material blurs it. SOAR encodes work analysts were already doing into playbooks an engineer maps in advance; the sequence is known before the alert arrives. An AI SOC agent decides which evidence to retrieve based on the alert, examines what comes back, and uses those findings to determine the next query. &ldquo;Agents decide which evidence to retrieve based on the alert, examine what comes back, and use those findings to determine the next query.&rdquo; That is a real difference in kind, and it also explains where each belongs: deterministic playbooks keep their role wherever the sequence genuinely is known in advance, which is most of containment and nearly all of enrichment. The conclusion is augmentation, not replacement.<\/p>\n<p>Every statistic in the piece is borrowed, so attribute each to its origin rather than to the article. KuppingerCole was tracking 39 AI SOC vendors as of April 2026, with 84 further candidate vendors identified beyond that &mdash; a category-count that tells you how much of the market is still undifferentiated. Microsoft and Omdia research supplies the demand-side case: 66% of SOCs lose 20% of their weekly time to data aggregation, and 42% of alerts go uninvestigated. Gartner supplies the counterweight, predicting more than 40% of agentic AI projects will be cancelled by the end of 2027. The author is a technology journalist of 24 years writing under Security Boulevard&rsquo;s Techstrong Council opinion category, with no vendor affiliation disclosed.<\/p>\n<p>The SC Media perspective is the same argument with the volume up, and it needs its provenance stated: it is written by Lee Rossey, CTO and co-founder of SimSpace, and it is a direct rebuttal to OpenAI president Greg Brockman&rsquo;s call to deploy agentic tools quickly with broad production access. Its headline contrast &mdash; nearly 80% of security leaders reporting high confidence in agentic capabilities while teams of similar maturity score just 30% on defensive readiness &mdash; comes from SimSpace&rsquo;s own <em>State of Agentic Cybersecurity<\/em> report and its own proving-grounds testing environment, not from independent research. It also quotes Flavio Villanustre, CISO at LexisNexis Risk Solutions, agreeing with Brockman in general while noting that OpenAI helped create the problem. Discount the figure for its source and the operational argument still stands, because it is the same one Microsoft&rsquo;s trial made from the other direction: the gain is mostly in workflow, so an agent granted broad production access before anyone has measured the workflow is being trusted with the part that was never the bottleneck. Measure your own aggregation time and uninvestigated-alert rate first. Those two numbers are the baseline any agent has to beat, and without them a pilot cannot be evaluated at all.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/securityboulevard.com\/2026\/09\/ai-soc-vs-soar-augmentation-or-replacement\/\">Security Boulevard (AI SOC vs. SOAR: augmentation or replacement?)<\/a> &middot; <a href=\"https:\/\/www.scworld.com\/perspective\/hastily-deployed-agentic-security-is-not-the-answer-to-enterprise-cyber-threats\">SC Media (hastily deployed agentic security &mdash; SimSpace perspective)<\/a><\/p>\n<\/p><\/div>\n<p>            <!-- Calls to action --><\/p>\n<h2>Calls to action<\/h2>\n<p>Nine things worth doing in the next week, drawn directly from this issue:<\/p>\n<ul style=\"font-size:14.5px;line-height:1.6;color:#1f2937;padding-left:20px;margin:0 0 14px 0;\">\n<li><strong>Re-point everything that consumes CISA&rsquo;s weekly vulnerability bulletin, before 28 September.<\/strong> Search your automation, digests and ticket rules for the bulletin as a source and move each one to KEV, alerts or advisories. While you are in that code, confirm your KEV tooling alerts on <em>updates<\/em> to existing entries and not only on new additions &mdash; roughly half the entries that flipped to known-exploited did so more than a year after first appearing, and none of those flips carried an alert.<\/li>\n<li><strong>Hunt for Alinubx.sys and the rest of the Rapuncel chain today.<\/strong> Look for driver loads claiming to be nvfsflt64.sys whose path or signer does not match NVIDIA&rsquo;s; for vsdbg.exe running from a non-standard path or under a renamed binary, with sideloaded DLLs beneath it; and for C2 traffic to 2.26.126[.]50. Then check your scanner size-exclusion threshold against the 148MB inflated archives, and add an alert for AV or EDR agents stopping in bulk on a host that stays up. The driver is not on Microsoft&rsquo;s blocklist yet, so blocklist-only control does not cover this.<\/li>\n<li><strong>Turn the four OAuth consent-abuse signals into detections.<\/strong> New application consents, newly created service principals, approvals of high-privilege scopes, and refresh-token activity from unfamiliar infrastructure. First confirm those events reach your SIEM with usable retention &mdash; in most estates they exist but are not routed. Then fix the playbook: the response to consent abuse is revoking the grant and the refresh tokens, so an &ldquo;account compromise&rdquo; runbook that says password reset and MFA re-enrolment does not cover this case.<\/li>\n<li><strong>Deploy three decoys this week using tooling you already own.<\/strong> CISA&rsquo;s guidance needs no procurement: fake administrator credentials in your IAM, a decoy folder on an executive desktop, and a bogus file with a plausible name, each wired to an alert &mdash; an unmonitored honeytoken is just a file. Use MITRE ATT&amp;CK to choose which techniques to place them against and MITRE Engage to plan. Then store the record of what is fake outside the production environment, which is the step most teams skip.<\/li>\n<li><strong>Measure your own detection coverage before you read another vendor&rsquo;s number.<\/strong> Map the rules actually deployed in your SIEM and EDR against MITRE ATT&amp;CK, and against ATLAS if you run AI workloads. One Equinox trial customer moved from 26.6% to 61.3% once the gaps were visible. Whatever any lab publishes about a product in the abstract, the coverage of the rules you have deployed is the number that governs your alerts.<\/li>\n<li><strong>Put your patch interval next to 51 minutes.<\/strong> Pull your median time from vendor advisory to production patch for one class of internet-facing asset and compare it with the 51 minutes it took to build a working exploit for Drupal CVE-2026-9082 from the published patch. If the comparison is as bad as it usually is, the follow-on action is exposure-layer coverage for the window &mdash; virtual patching and WAF rules as primary control, not as fallback.<\/li>\n<li><strong>Add a security look to unexplained early-morning outages.<\/strong> The LockBit intrusion at UHSP presented first as a 4:30 AM outage and stayed undetected through it, encrypting only during a second failure days later. Check whether your escalation path sends that first call to infrastructure alone. And write the verification lesson into your ransomware playbook: LockBit claimed 200GB, posted 2GB, and four people were ultimately notified &mdash; do not let an attacker&rsquo;s claimed volume drive your notification posture before you have tested it.<\/li>\n<li><strong>Baseline the two numbers any AI SOC pilot has to beat.<\/strong> Measure the share of weekly analyst time going to data aggregation and the share of alerts that go uninvestigated &mdash; the Microsoft\/Omdia figures are 20% and 42%. Without your own versions of those you cannot evaluate a pilot. And ask any vendor how much of their published gain survives holding queue management constant, since 83% of Microsoft&rsquo;s measured trial gain came from queue reordering and auto-resolution rather than verdict quality.<\/li>\n<li><strong>Close the false &lsquo;Defender Antivirus is turned off&rsquo; tickets, and check the Teams control&rsquo;s real date.<\/strong> The false notification affected all supported Windows client and server versions including Windows 11 26H1 and Windows Server 2025, and was fixed by Defender Antivirus platform version 4.18.26080.4 on 2026-09-17 &mdash; confirm that version is deployed, then close anything opened against those alerts. Separately, do not write policy around Teams custom-file-extension blocking yet: it is roadmap item 571298, in development, targeted for November 2026, and admins cannot modify the blocked-file-type list at all today.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<p>        <!-- Footer --><\/p>\n<tr>\n<td class=\"footer\">\n<p class=\"brand\">Security Operations Weekly<\/p>\n<p>A weekly intelligence bulletin from Security Radar LLC.<br \/>\n            Curated by Paul Davis &middot; <a href=\"mailto:paul.davis@security-radar.com\">paul.davis@security-radar.com<\/a><\/p>\n<p>&copy; 2026 Security Radar LLC. All rights reserved.<\/p>\n<p>Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.<\/p>\n<p>*|LIST:ADDRESS|*<\/p>\n<p><a href=\"*|ARCHIVE|*\">View this email in your browser<\/a> &middot; <a href=\"*|UNSUB|*\">Unsubscribe<\/a><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>September 20, 2026 &middot; Weekly Edition Security Operations Weekly Four vendors published four incompatible classes of security-AI evidence inside two weeks, and there is no common unit to put them on. SE Labs opens a rival test programme with five vendors signed up while MITRE ATT&amp;CK Evaluations participation falls from&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38],"tags":[],"class_list":["post-5930","post","type-post","status-publish","format-standard","hentry","category-security-operations"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5930"}],"version-history":[{"count":1,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5930\/revisions"}],"predecessor-version":[{"id":5931,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5930\/revisions\/5931"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}