Download this webinar to explore findings from the 2025 State of SIEM Detection Risk Report and learn how to implement best practices aligned to the report’s key takeaways. In this recording, Dr. Anton Chuvakin, Senior
In our fifth annual report, CardinalOps analyzed a range of production SIEM environments to evaluate the coverage, health and overall performance of enterprise threat detection programs. This report includes the data of 13,000 detection rules
Detection engineering isn’t just about finding bad behavior. It’s about understanding how attackers appear normal—on accident or by design. Some of the most successful evasion techniques don’t involve zero-days or encryption. They rely on you writing
What Is Polymorphic AI Malware? Polymorphic AI malware refers to a new class of malicious software. It leverages artificial intelligence models, such as GPT-based language models, to dynamically generate, obfuscate, or modify its own code
False positives aren’t just annoying. They’re corrosive. Every unnecessary alert chips away at the analyst’s attention span. Every poorly designed rule teaches the SOC to distrust its own tools. Every noisy detection makes it harder
Linux systems are often overlooked when setting up security auditing and threat detection strategies. The main reason is that Linux auditing is far less explored by the security community than Windows auditing. A survey done
CardinalOps provides the only AI-powered exposure management platform that unifies prevention and detection controls to drive intelligent prioritization and remediation of your riskiest exposures.
CardinalOps Detection Posture Management automates detection engineering processes and continuously expands your MITRE ATT&CK coverage, ensuring you detect the threats that matter most.
During the SANS Spring Cyber Solutions Fest’s Detection & Response track, Jay Lillie, CardinalOps VP of Customer Success, and Dr. Anton Chuvakin, Advisor to the Google Office of the CISO, discussed ways to improve SOC
Soon over 40,000 people will gather in San Francisco for this year’s RSA conference. Many consider RSAC the industry’s most significant event (though Black Hat / DEF CON would disagree…). Legions of vendors, practitioners, investors,
You’re probably familiar with the classic thought experiment: If a tree falls in a forest and no one is around to hear it, does it make a sound? In cybersecurity, we can ask a similar
When considering KPIs for your SOC, mean time to detect, contain, and remediate (MTTR, MTTC, and MTTR); incident and alert volumes; and false positive rates get most of the attention. Regularly monitoring these higher-level metrics