Threat Detection & Incident Response
Top Stories
-
Feature
29 Jul 2026
Vulnerability management needs an update for the AI era
AI accelerates exploit timelines from months to hours. Organizations must shift from patch-all to risk-based prioritization using exploitability metrics. Continue Reading
-
Tip
21 Jul 2026
Behavioral biometrics: How to detect nonhuman threat actors
How do security teams distinguish between people and AI? It's getting harder, but behavioral biometrics might help discern human users from machine impersonators. Continue Reading
-
Tip
09 Jul 2026
How to operationalize threat modeling with AI
AI tools streamline threat modeling by automating repetitive tasks and helping security teams prioritize risks more effectively. But human oversight is still critical. Continue Reading
-
Tip
22 Jun 2026
A CISO's guide to infostealers: Prevention and detection
Infostealers aren't new. But what is new is that almost anyone -- regardless of skill -- can now deploy the malware. Update incident response plans to safeguard your operations. Continue Reading
-
News
12 Jun 2026
What CISA's new remediation directive means for CISOs
CISA's updated directive for federal agencies compresses mandatory patching timelines to just three days for high-risk flaws, urging practitioners to 'patch smarter, not harder.' Continue Reading
-
News
12 Jun 2026
It's time to update incident response for the AI era
Your latest cybersecurity incident might not be a threat actor, but an internal AI agent doing what it's authorized to do. Incident response must evolve to accommodate AI. Continue Reading
-
Conference Coverage
10 Jun 2026
Gartner Security & Risk Management Summit 2026: Adapting for AI
Check out SearchSecurity's Gartner Security & Risk Management Summit guide for reports on notable presentations and sessions on the latest security topics. Continue Reading
-
Definition
10 Jun 2026
What is incident response? A complete guide
Incident response is an organized, strategic approach to detecting and managing cyberattacks in ways that minimize damage, recovery time and total costs. Continue Reading
-
News
27 May 2026
For CISOs, dawn of OpenAI Daybreak brings good and bad news
OpenAI Daybreak shows how AI reshapes vulnerability discovery. But AI-driven security tools raise accountability questions and fuel the AI arms race between defenders and attackers. Continue Reading
-
Feature
30 Mar 2026
How AI caught a malicious North Korean insider at Exabeam
A North Korean posing as an American tech worker used GenAI to infiltrate Exabeam's network. But agentic AI found the signals among UEBA noise and exposed him in a matter of seconds. Continue Reading
-
Tip
23 Mar 2026
Top vulnerability scanning tools for security teams
Use these vulnerability scanning tools to find weaknesses and potential exploits in web applications, IT and cloud infrastructure, IoT devices and more. Continue Reading
-
Video
16 Mar 2026
Lessons in incident response from the Olympics, World Cup
Cybersecurity lessons from global sports events show that preparation, defense and quick recovery are essential to besting adversaries. Continue Reading
-
Tip
13 Mar 2026
Streamline SecOps with SOAR workflows and playbooks
Through their automated workflows and playbooks, SOAR platforms help SOC teams overcome limited resources, skills gaps and alert fatigue. Continue Reading
-
Feature
20 Feb 2026
How to build an incident response plan, with examples, template
Threats from cyberattacks continue to grow in frequency and severity. Considering the potential disruptions from such events, an organization needs an incident response plan. Continue Reading
-
Tip
12 Feb 2026
How to build an incident response framework
Frameworks provide the structure for an effective incident response program. Here's where to turn for guidance on what to include. Continue Reading
-
Tip
10 Feb 2026
Top incident response certifications to consider in 2026
Cybersecurity professionals pursuing an incident response track should consider the following certifications to bolster their knowledge and advance their careers. Continue Reading
-
Tip
30 Jan 2026
5 deepfake detection tools to protect enterprise users
Deepfakes are wreaking havoc worldwide -- and they're likely just getting started. To fight fire with fire, CISOs should consider AI-enabled deepfake detection tools. Continue Reading
-
Tip
15 Jan 2026
10 important incident response metrics and how to use them
In incident response, security teams can improve their work by knowing how long it takes to respond to and remediate threats. These are the key metrics to track. Continue Reading
-
Tip
09 Jan 2026
How to create an incident response playbook
Learn how to build actionable, repeatable incident response playbooks that guide your team through every step of handling cybersecurity events effectively. Continue Reading
-
Tip
22 Dec 2025
2026 guide to digital forensics tools for enterprises
After a data breach, organizations and law enforcement need to understand what happened. These 10 digital forensics tools collect the key evidence required for an investigation. Continue Reading
-
Tip
17 Dec 2025
How to detect a deepfake with visual clues and AI tools
Forewarned is forearmed, but too many employees don't realize how sophisticated deepfakes have become. Integrate these deepfake detection tips into security awareness training. Continue Reading
-
Tip
16 Dec 2025
Incident response: How to implement a communication plan
Communication is critical to an effective incident response plan. Here are best practices for communication planning and an editable template to help you get started. Continue Reading
-
Tip
03 Nov 2025
Browser detection and response fills gaps in security programs
BDR is the latest tool to address detection and response as more and more communication occurs over Edge, Chrome and their counterparts. But does your organization really need it? Continue Reading
-
Tip
16 Oct 2025
7 top deception technology vendors for active defense
Once reserved for the most mature organizations, cyber deception technology is picking up steam on the ground and in practice. Here are seven platforms for CISOs to consider. Continue Reading
-
Tip
08 Aug 2025
How to prevent DoS attacks and what to do if they happen
The worst DoS attacks are like digital tsunamis that put critical business operations at risk. Learn how they work, ways to stop them and how systems can withstand the flood. Continue Reading
-
Definition
07 Aug 2025
What is the Mitre ATT&CK framework?
The Mitre ATT&CK -- pronounced miter attack -- framework is a free, globally accessible knowledge base that describes the latest behaviors and tactics of cyberadversaries to help organizations strengthen their cybersecurity strategies. Continue Reading
-
Tip
04 Aug 2025
How to recover from a ransomware attack: A complete guide
With a ransomware recovery plan, organizations can act quickly to prevent data loss without descending into chaos. Learn the crucial steps to incorporate into your plan. Continue Reading
-
Tip
31 Jul 2025
How to remove ransomware, step by step
Prevention is the best weapon against a ransomware infection. But in the event of compromise, consider these responses to contain and remove ransomware. Continue Reading
-
Tip
09 Jul 2025
Incident response tabletop exercises: Guide and template
Have an incident response plan but aren't running incident response tabletop exercises? These simulations are key to knowing if your plan will work during an actual security event. Continue Reading
-
Definition
18 Jun 2025
What is an advanced persistent threat (APT)?
An advanced persistent threat (APT) is a prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period. Continue Reading
-
Feature
16 Jun 2025
How AI threat detection is transforming enterprise cybersecurity
AI-powered threat detection transforms cybersecurity by using machine learning to analyze network traffic, user behaviors and data access patterns. Continue Reading
-
Definition
14 May 2025
What is penetration testing?
A penetration test, also called a 'pen test,' is a simulated cyberattack on a computer system, network or application to identify and highlight vulnerabilities in an organization's security posture. Continue Reading
-
Tip
15 Apr 2025
How to effectively respond to a ransomware attack
Does your organization know what to do if its systems are suddenly struck by a ransomware attack? To be ready, prepare your ransomware response well ahead of time. Continue Reading
-
Feature
11 Apr 2025
Ransomware negotiation: Does it work, and should you try it?
Negotiating with the criminals who are holding your data for ransom is a daunting and stressful endeavor. Experts weigh in on the risks and the potential outcomes. Continue Reading
-
Answer
08 Apr 2025
How to report ransomware attacks: Steps to take
The Cybersecurity and Infrastructure Security Agency and FBI recommend reporting ransomware attacks to the authorities as soon as possible. Continue Reading
-
Feature
03 Apr 2025
4 ransomware detection techniques to catch an attack
While prevention is key, it's not enough to protect a company's systems from ransomware. Learn how early detection with these four methods helps reduce damage from attacks. Continue Reading
-
Feature
11 Mar 2025
Incident response for web application attacks
Web app security is like learning to ride a bike -- expect to struggle before getting it right. But don't be disheartened; learn from prior incidents to improve controls. Continue Reading
-
Definition
12 Feb 2025
What is antimalware?
Antimalware is a software program created to protect IT systems and individual computers from malicious software, or malware. Continue Reading
-
Definition
11 Feb 2025
What is a honeypot? How it protects against cyberattacks
A honeypot is a network-attached system set up as a decoy to lure cyberattackers and to help organizations detect, deflect and study hacking attempts to gain unauthorized access to IT. Continue Reading
-
News
06 Feb 2025
Unpatched.ai: Who runs the vulnerability discovery platform?
There is limited information on the AI-powered vulnerability discovery platform that emerged in December after it reported Microsoft vulnerabilities Continue Reading
-
News
05 Feb 2025
Chainalysis records 35% decrease in ransom payments in 2024
While the first half of 2024 was on pace to surpass 2023's record-setting numbers, Chainalysis found that the volume of ransom payments dropped in the second half of the year. Continue Reading
-
Feature
30 Dec 2024
Navigate the 2025 threat landscape with expert insights
AI technology and company employees can serve as both gateways and buffers against cyberthreats. Learn more from expert thought leaders on how to protect your environment in 2025. Continue Reading
-
Tip
16 Dec 2024
How to mitigate wiper malware
A wiperware cyberattack can change the game for organizations because it causes complete destruction of data and systems. Find out how to protect your organization. Continue Reading
-
Tip
04 Dec 2024
How to recover from a DDoS attack
Learn how to recover from a DDoS attack and get operations back online quickly, while minimizing impact on customers and brand reputation. Continue Reading
-
News
02 Dec 2024
AWS launches automated service for incident response
AWS Security Incident Response, which launched ahead of the re:Invent 2024 conference this week, can automatically triage and remediate events detected in Amazon GuardDuty. Continue Reading
-
Definition
22 Nov 2024
What is endpoint detection and response (EDR)?
Endpoint detection and response (EDR) is a system that gathers and analyzes security threat-related information from computer workstations and other endpoints. Continue Reading
-
News
21 Nov 2024
Cyber insurers address ransom reimbursement policy concerns
In a recent op-ed for The Financial Times, U.S. Deputy National Security Advisor Anne Neuberger wrote that reimbursing ransom payments is a 'troubling practice that must end.' Continue Reading
-
Tip
12 Nov 2024
EDR vs. XDR vs. MDR: Key differences and benefits
One of the most important goals of cybersecurity professionals is to quickly identify potential or in-progress cyberattacks. These three approaches can help. Continue Reading
-
News
04 Nov 2024
CISA: U.S. election disinformation peddled at massive scale
CISA said the U.S. cybersecurity agency has seen small-scale election incidents 'resulting in no significant impacts to election infrastructure,' such as low-level DDoS attacks. Continue Reading
-
Definition
01 Nov 2024
What is unified threat management (UTM)?
Unified threat management (UTM) is an information security system that provides a single point of protection against cyberthreats, including viruses, worms, spyware and other malware, as well as network attacks. Continue Reading
-
Tip
28 Oct 2024
Insider threat hunting best practices and tools
Detecting threats coming from inside the organization presents unique challenges. Insider threat hunting helps identify potential threat actors and proactively deal with them. Continue Reading
-
Feature
24 Oct 2024
Equipment to include in a computer forensic toolkit
Computer forensic investigators require more than software to do their job. Learn what equipment constitutes a complete computer forensic toolkit. Continue Reading
-
Tip
24 Oct 2024
EDR vs. SIEM: Key differences, benefits and use cases
Endpoint detection and response and security information and event management tools offer organizations benefits, but each plays a specific role, so it's worth having both. Continue Reading
-
Tip
24 Oct 2024
EDR vs. EPP: How are they different and which is right for you?
Endpoint detection and response tools and endpoint protection platforms offer similar security features. Which is better for your organization: EDR, EPP or both? Continue Reading
-
Tip
22 Oct 2024
Threat intelligence vs. threat hunting: Better together
Understanding and using threat intelligence and threat hunting together provides enterprises with a well-rounded security posture. Find out how to build your plan. Continue Reading
-
Tip
22 Oct 2024
How to detect DDoS attacks
DDoS attacks are on the rise -- again. While they usually strike without warning, there are some red flags to be aware of. Rapid detection is key to surviving such an attack. Continue Reading
-
Tip
15 Oct 2024
7 common intrusion detection system evasion techniques
Malicious attackers use various evasion tactics to infiltrate networks without intrusion detection systems noticing. Learn what these techniques are and how to mitigate them. Continue Reading
-
Definition
10 Oct 2024
What is extended detection and response (XDR)?
Extended detection and response (XDR) is a technology-driven cybersecurity process designed to help organizations detect and remediate security threats across their entire IT environment. Continue Reading
-
Tip
16 Sep 2024
Explaining cybersecurity tabletop vs. live-fire exercises
Tabletop games and live-fire exercises are two ways to test the effectiveness of enterprise security controls and defenses. Discover how each works and how they differ. Continue Reading
-
Tip
13 Sep 2024
How AI could change threat detection
AI is changing technology as we know it. Discover how it's already improving organizations' ability to detect cybersecurity threats and how its benefits could grow as AI matures. Continue Reading
-
Definition
12 Sep 2024
What is threat detection and response (TDR)? Complete guide
Threat detection and response (TDR) is the process of recognizing potential cyberthreats and reacting to them before harm can be done to an organization. Continue Reading
-
Tip
06 Sep 2024
Threat hunting frameworks, techniques and methodologies
Threat hunting's proactive approach plays a vital role in defending against cyberattacks. Learn about the frameworks, methodologies and techniques that make it so effective. Continue Reading
-
Definition
06 Sep 2024
What is MXDR, and do you need it?
Managed extended detection and response (MXDR) is an outsourced service that collects and analyzes threat data from across an organization's IT environment. Continue Reading
-
Tip
05 Sep 2024
What is threat hunting? Key strategies explained
If you are ready to take a more proactive approach to cybersecurity, threat hunting might be a tactic to consider. Here's what security teams should know. Continue Reading
-
Tip
04 Sep 2024
Use AI threat modeling to mitigate emerging attacks
AI threat modeling can help enterprise security teams identify weaknesses in their AI systems and apps -- and keep bad actors from exploiting them. Continue Reading
-
Tip
29 Aug 2024
How AI will transform vulnerability management for the better
Artificial intelligence is improving how enterprises address security vulnerabilities, resulting in stronger security postures and smaller attack surfaces. Learn more. Continue Reading
-
Feature
27 Aug 2024
Infosec industry calls for more public sector collaboration
As cyberattacks continue to rise, infosec professionals address the need to increase private and public sector partnerships to assist law enforcement operations. Continue Reading
-
Podcast
26 Aug 2024
Risk & Repeat: National Public Data breach questions remain
The breach of National Public Data may have put billions of personal records at risk, but the scope of the attack and impact on consumers are still unclear. Continue Reading
-
News
22 Aug 2024
GuidePoint talks ransomware negotiations, payment bans
GuidePoint Security's Mark Lance discusses the current ransomware landscape and the steps that go into negotiating potential payments with cybercriminal gangs. Continue Reading
-
Definition
20 Aug 2024
What is cloud detection and response (CDR)?
Cloud computing requires a security approach that is different than traditional protections. Where does cloud detection and response fit into a cybersecurity strategy? Continue Reading
-
Tip
19 Aug 2024
Guide to data detection and response (DDR)
Data is one of the most important assets in any organization. To truly protect it, you need a DDR strategy. Here's what you need to know, with tips on buying DDR tools. Continue Reading
-
Tip
15 Aug 2024
How to select an MDR security service
With the threat landscape as challenging as it is, organizations are looking for reinforcements. One option is to bolster detection and response via third-party MDR services. Continue Reading
-
Opinion
30 Jul 2024
Be prepared for breach disclosure and a magnitude assessment
Organizations need to take a proactive approach to monitoring data stores continuously, and in the case of a breach, assess the magnitude quickly and accurately. DSPM can help you. Continue Reading
-
News
26 Jul 2024
BitLocker workaround may offer aid for CrowdStrike customers
CrowdStrike customers grappling with blue screens of death from the recent IT outage may be able to sidestep BitLocker encryption schemes and recover their Windows systems. Continue Reading
-
Definition
26 Jul 2024
What is malware? Prevention, detection and how attacks work
Malware, or malicious software, is any program or file that's intentionally harmful to a computer, network or server. Continue Reading
-
Feature
25 Jul 2024
The differences between open XDR vs. native XDR
Extended detection and response tools are open or native. Learn the differences between them, and get help choosing the right XDR type for your organization. Continue Reading
-
Tip
24 Jul 2024
Types of MDR security services: MEDR vs. MNDR vs. MXDR
Considering MDR security services? There's more than one option available; learn how to find the best for your organization's security needs. Continue Reading
-
Podcast
23 Jul 2024
Risk & Repeat: Faulty CrowdStrike update causes global outage
Friday's outage, which was caused by a defective CrowdStrike channel file update, resulted in significant disruptions for airlines, critical infrastructure and more. Continue Reading
-
Tip
22 Jul 2024
8 cloud detection and response use cases
Unsure whether cloud detection and response is useful for your organization? These eight use cases could make CDR indispensable. Continue Reading
-
Tip
22 Jul 2024
Cloud detection and response: CDR vs. EDR vs. NDR vs. XDR
Cloud detection and response is the latest detection and response tool. Explore how it differs from endpoint, network and extended detection and response tools. Continue Reading
-
Podcast
16 Jul 2024
Risk & Repeat: AT&T's Snowflake database breached
AT&T disclosed a breach in which threat actors compromised the company's Snowflake instance and stole call and text records from 'nearly all' the company's cellular customers. Continue Reading
-
Definition
15 Jul 2024
What is an intrusion detection system (IDS)?
An intrusion detection system monitors (IDS) network traffic for suspicious activity and sends alerts when such activity is discovered. Continue Reading
-
Tip
26 Jun 2024
What qualifies as a material cybersecurity incident?
In SEC rules, a cyberincident's materiality hinges on its potential impact on a public company's standing. Learn what this means for cybersecurity disclosure requirements. Continue Reading
-
Tip
25 Jun 2024
EDR vs. antivirus: What's the difference?
Endpoint detection and response and antivirus tools both protect enterprise networks, and both have distinct advantages. Which is better for your organization? Continue Reading
-
Definition
07 Jun 2024
proof of concept (PoC) exploit
A proof of concept (PoC) exploit is a nonharmful attack against a computer or network. PoC exploits are not meant to cause harm, but to show security weaknesses within software. Continue Reading
-
Tip
05 Jun 2024
How to write a useful cybersecurity incident report
Reacting to a cybersecurity event is just half the battle. An incident report can help companies understand why the attack occurred and how to avoid future security issues. Continue Reading
-
News
23 May 2024
CISA executive director discusses CIRCIA, incident reporting
CISA Executive Director Brandon Wales speaks with TechTarget Editorial to discuss CIRCIA and the importance of incident reporting to the larger cybersecurity ecosystem. Continue Reading
-
Definition
21 May 2024
cloud penetration testing
Cloud penetration testing is a tactic an organization uses to assess its cloud security effectiveness by attempting to evade its own defenses. Continue Reading
-
Feature
15 May 2024
Lessons learned from high-profile data breaches
Equifax. Colonial Pipeline. Sony. Target. All are high-profile data breaches, and all offer key lessons to learn that prevent your organization from falling victim to an attack. Continue Reading
-
News
08 May 2024
National Security Agency warns against paying ransoms
Rob Joyce and David Luber, former and current directors of cybersecurity at the NSA, discuss how the ransomware attack on Change Healthcare exemplified the cons of paying ransoms. Continue Reading
-
News
07 May 2024
SentinelOne: Ransomware actors are adapting to EDR
At RSA Conference 2024, SentinelOne's Alex Stamos discussed ongoing global threats such as ransomware and how threat actors are changing their techniques. Continue Reading
-
News
06 May 2024
Google unveils new threat intelligence service at RSAC 2024
Google Threat Intelligence combines investigation findings from Mandiant with crowdsourced intelligence from VirusTotal and operationalizes the data with Google's Gemini AI model. Continue Reading
-
News
06 May 2024
Splunk details Sqrrl 'screw-ups' that hampered threat hunting
At RSA Conference 2024, Splunk's David Bianco emphasizes that enterprises need revamped threat hunting frameworks to help with threat detection and response challenges. Continue Reading
-
News
22 Apr 2024
Mitre breached by nation-state threat actor via Ivanti flaws
An unnamed nation-state threat actor breached Mitre through two Ivanti Connect Secure zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, disclosed earlier this year. Continue Reading
-
Tip
12 Apr 2024
Pros and cons of 7 breach and attack simulation tools
Breach and attack simulation software can significantly beef up an organization's network defense strategy. But not all tools are made equally. Continue Reading
-
Definition
10 Apr 2024
fraud detection
Fraud detection is a set of activities undertaken to prevent money or property from being obtained through false pretenses. Continue Reading
-
Tip
02 Apr 2024
Cloud computing forensics techniques for evidence acquisition
With the proper tools and methodologies, security teams can provide analysts with the critical pieces required to complete cloud computing forensics investigations. Continue Reading
-
Tutorial
22 Mar 2024
Fuzzy about fuzz testing? This fuzzing tutorial will help
Organizations are searching for ways to automate and improve their application security processes. Fuzz testing is one way to fill in some of the gaps. Continue Reading
-
Opinion
15 Mar 2024
Cloud detection and response is, and will stay, a team sport
CISOs should push for federated technologies, common processes and formal communications between teams to ensure cloud detection and response is effective and efficient. Continue Reading
-
Definition
27 Feb 2024
computer forensics (cyber forensics)
Computer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. Continue Reading
-
Tip
22 Feb 2024
Use cloud threat intelligence to protect critical data and assets
Cloud threat intelligence helps identify and analyze cloud-based threats, enabling security teams to better understand attacks and more proactively defend against them. Continue Reading
-
Tip
13 Feb 2024
How to conduct a social engineering penetration test
Social engineering attacks are becoming more sophisticated and more damaging. Penetration testing is one of the best ways to learn how to safeguard your systems against attack. Continue Reading