Technical insights on whitelist intelligence, SOC optimization, and reducing false positives
Our weekly read on the infosec landscape through an infrastructure-reputation lens. This week: AI agents spinning up C2 in minutes behind trusted infra, npm and GitHub abused at scale, and the first US sanction of a VPN provider for enabling ransomware.
Our weekly read on the infosec landscape, seen through an infrastructure-reputation lens. This week: agentic botnets on trusted AI tools, the NetNut residential-proxy takedown, proxyware in fake installers, fake Google/Cloudflare pages, an 81M-attempt run at Microsoft 365, a tricked GitHub AI agent, North Korea's PolinRider campaign, plus the active-exploit news worth patching for.
Most SOC alert triage advice starts with the blocklist. That's backwards. Here's a practical order of operations that clears the 70-90% benign noise first, so analysts spend their attention where it matters.
A live phishing kit stages its lures on Google Cloud Storage to borrow Google's good name. We used the campaign to pressure-test our own rule that big-brand cloud is never automatically benign, and tightened two things along the way.
A real case from this week: a Microsoft Teams IP showing up as 'Commercial VPN' in our API. The root cause is in your upstream feeds, the fix is in the ASN, and the design question is harder than either.
Alert fatigue is the worst-kept secret in security. Here's the math on what false positives actually cost, what's triggering them in 2026, and what a honest whitelist intelligence response looks like.
Start using whitelist intelligence today. Free plan includes 500 queries/day.