Insights that keep you ahead

Closing the Forensics Gap: How Exaforce does Automated, AI-powered remote forensics on endpoints

ResearchBleon ProkoNovember 6, 2026

PHP2Shell, LiteLLM, and Node.js: Inside Exaforce’s Real-World Customer Threat Hunts

IndustryJan Michálek, Joseph Odyn, Michael LangdonOctober 28, 2026

An analysis of PHP2Shell: CVE-2026-109618 & CVE-2026-109619 Critical PHP Remote Code Execution

ResearchBleon ProkoOctober 22, 2026

Context-Rich Detection: Using Everything We Know

ProductDevesh MittalOctober 7, 2026

From Raw Logs to Semantic Intelligence

ProductDevesh MittalSeptember 17, 2026

Expanding beyond the SOC: Introducing Exaforce Agentless AI Security

ProductLahav Ezer, Ankur SinglaSeptember 15, 2026

Why SIEMs Fall Short for Modern Threat Detection

ProductDevesh MittalSeptember 11, 2026

No Off-the-Shelf Kit Required: An overview of a custom AiTM phishing campaign found in the wild and the mechanisms behind it

ResearchBleon ProkoSeptember 9, 2026

San Francisco tattooed Exaforce’s first billboards campaign. And honestly, we get it.

NewsAnkur SinglaSeptember 2, 2026

Caught in the Middle: Responding to an AiTM Credential Heist

ResearchBleon ProkoAugust 18, 2026

Introducing InfOSAStealer: ClickFix Delivery, Fake System Dialogs, and the Quiet Trojanization of Hardware Wallet Software

ResearchBleon ProkoAugust 11, 2026

Introducing “ExaGo”: Your SOC Now Goes Anywhere You Go

IndustryAqsa Taylor, Jakub Pavlik, Ankur SinglaJuly 28, 2026

You don’t see me, therefore I am: Taking a look at abusing GitHub’s first party sessions for initial access

ResearchBleon ProkoJuly 27, 2026

Learning from the Exaforce frontline: Detecting GitHub OAuth Token Compromise

IndustryKavita Varadarajan, Joseph Odyn, Shang LiJuly 24, 2026

The Agentic SOC, Grounded in the Network

ProductAaron RohyansJuly 22, 2026

The SIEM Possible Challenge: Moving From Events to Answers in a Modern SOC

IndustryAqsa TaylorJune 23, 2026

Claude meets the SOC: Removing the AI blind spot

ProductDevesh Mittal, Eddie ParraJune 12, 2026

AWS validated us for AI and Security. Here is what that means.

NewsEddie ParraJune 9, 2026

What the 2026 Latio Security Operations Market Report Gets Right About the AI SOC

NewsAriful HuqJune 4, 2026

Defending at the speed of AI: Announcing our $125M Series B

NewsAnkur SinglaMay 12, 2026

Exaforce and Wiz: Connecting cloud security findings to SOC response

ProductTaylor SmithApril 28, 2026

Vibe Hunting: A New Model for Threat Hunting Beyond SIEM Queries

IndustryAqsa Taylor, Ariful HuqApril 6, 2026

The Exabots are on strike (this is fine)

ProductExaforceApril 1, 2026

There’s a bot in my boot! Finding if hackerbot-claw tried tampered with your workflows

ResearchAqsa Taylor, Bleon ProkoMarch 11, 2026

What can this compromised user actually do? Why effective permissions are a cornerstone of accurate threat analysis

ProductKavita Varadarajan, Steven MoyMarch 4, 2026

Rethinking MSSP repatriation: AI SOCs, in-house builds, and the middle ground

IndustryKeith Buswell, Taylor SmithFebruary 17, 2026

The Phishing Matryoshka: Unpacking a BEC to AiTM Nested Attack Chain

ResearchJoseph Odyn, Bleon ProkoJanuary 28, 2026

The breach already inside: Operationalizing insider risk management

ProductTaylor SmithJanuary 21, 2026

7 predictions for the security landscape in 2026

IndustryKeith Buswell, Nuno Ferriera, Taylor SmithJanuary 13, 2026

Exaforce Agentic SOC 2025 year in review

IndustryAriful HuqDecember 29, 2025

Learning from the Exaforce frontline: When trusted third parties behave like threat actors

Customer StoryNuno FerrieraDecember 19, 2025

The Call Is Coming from Inside the House: 6 Strategies for Insider Risk

IndustryTaylor SmithDecember 16, 2025

Lessons from the hallways at my first AWS re:Invent

IndustryJoe MillikenDecember 8, 2025

Learning from the Exaforce frontline: Detecting and interrupting a sophisticated Google Workspace intrusion with agentic AI security

Customer StoryJoseph OdynNovember 25, 2025

Feeding the worm a soft cloudy bun: The second coming of Shai-Hulud

ResearchBleon Proko, Taylor SmithNovember 24, 2025

How an AI SOC turns Anthropic’s intelligence report into daily defense

IndustryMarco RodriguesNovember 11, 2025

Your AI-driven threat hunting is only as good as your data platform and pipeline

IndustryTaylor SmithNovember 6, 2025

The log rings don’t lie: historical enumeration in plain sight

ResearchBleon ProkoNovember 5, 2025

The past, present, and future of security detections

ProductKavita VaradarajanOctober 29, 2025

We’re HITRUST certified: strengthening trust across cloud-native SOC automation

ProductNuno FerrieraOctober 16, 2025

GPT needs to be rewired for security

IndustryAnkur SinglaOctober 9, 2025

Aggregation redefined: Reducing noise, enhancing context

ProductKavita VaradarajanOctober 8, 2025

Exaforce selected to join the 2025 AWS Generative AI Accelerator

NewsAnkur SinglaOctober 7, 2025

Do you feel in control? Analysis of AWS CloudControl API as an attack tool

ResearchBleon ProkoOctober 2, 2025

Exaforce Named a Leader and Outperformer in the 2025 GigaOm Radar for SecOps Automation

NewsDhruv GuptaSeptember 25, 2025

How agentic AI simplifies GuardDuty incident response playbook execution

IndustryTaylor SmithSeptember 24, 2025

There’s a snake in my package! How attackers are going from code to coin

ResearchBleon ProkoSeptember 10, 2025

Ghost in the Script: Impersonating Google App Script projects for stealthy persistence

ResearchBleon Proko, Jakub PavlikSeptember 9, 2025

Learning from the Exaforce frontline: How Exaforce detected an account takeover attack in a customer’s environment, leveraging our multi-model AI

Customer StoryKeith BuswellSeptember 3, 2025

s1ngularity supply chain attack: What happened & how Exaforce protected customers

IndustryDevesh Mittal, Taylor SmithAugust 27, 2025

Meet Exaforce: The full-lifecycle AI SOC platform

NewsAriful Huq, Taylor SmithAugust 26, 2025

Introducing Exaforce MDR: A Managed SOC That Runs on AI

ProductMarco RodriguesAugust 26, 2025

Building trust at Exaforce: Our journey through security and compliance

ProductNuno FerrieraAugust 21, 2025

Fixing the broken alert triage process with more signal and less noise

IndustryTaylor SmithAugust 7, 2025

Evaluate your AI SOC initiative

ProductTaylor SmithJuly 16, 2025

One LLM does not an AI SOC make

IndustryAndrew GreenJuly 10, 2025

Detections done right: Threat detections require more than just rules and anomaly detection

IndustryKavita VaradarajanJune 24, 2025

The KiranaPro breach: A wake-up call for cloud threat monitoring

IndustryMarco RodriguesJune 10, 2025

3 points missing from agentic AI conversations at RSAC

IndustryMarco RodriguesMay 29, 2025

5 reasons why security investigations are broken - and how Exaforce fixes them

ProductKavita VaradarajanMay 27, 2025

Bridging the Cloud Security Gap: Real-World Use Cases for Threat Monitoring

ProductMadhukar NayakbommanMay 7, 2025

Reimagining the SOC: Humans + AI bots = Better, faster, cheaper security & operations

NewsAnkur SinglaApril 17, 2025

Safeguarding against Github Actions(tj-actions/changed-files) compromise

IndustryMadhukar Nayakbomman, Devesh MittalMarch 16, 2025

Npm provenance: bridging the missing security layer in JavaScript libraries

IndustryJakub Pavlik, Marco RodriguesNovember 6, 2024

Exaforce’s response to the LottieFiles npm package compromise

IndustryJakub Pavlik, Marco RodriguesNovember 1, 2024