;
;

Sophos Blogs

Latest blog posts and insights from Sophos

Website Twitter Linkedin Facebook

Is “SIEM-less” really what it sounds like?

SIEM-less security may sound like an escape from traditional SIEM complexity and costs, but the underlying capabilities still have to exist somewhere.
Posted on 23 October 2026 | 12:00 am

Web App Owners – You’re on Notice. Your Low-Hanging Fruit Just Got Lower

Recent incident response investigations reveal how AI-assisted attackers are chaining web application vulnerabilities, credential theft, privilege ...
Posted on 21 October 2026 | 12:00 am

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Posted on 21 October 2026 | 12:00 am

Why Incident Response Demand Will Grow Faster than Expected

A perspective on AI-enabled attacker scale, defender capacity, and the growing need for experienced responders.
Posted on 20 October 2026 | 12:00 am

BRONZE SANDCASTLE deploys modified Meterpreter shells

The China-based threat group uses DLL sideloading in these attacks
Posted on 20 October 2026 | 12:00 am

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants
Posted on 19 October 2026 | 12:00 am

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

No novelty required to be effective
Posted on 19 October 2026 | 12:00 am

Sophos ITDR expands identity protection for the AI era

Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment.
Posted on 15 October 2026 | 12:00 am

Show, don’t tell: Sophos AI at CAMLIS

The Sophos AI team presents a novel technique for calibrating agentic SOC analysts
Posted on 14 October 2026 | 12:00 am