Sysdig

09/03/2026

Cloud attacks go from initial access to business impact in 10 minutes or less. The 555 Benchmark exists because that window is not a theory. It's what the Sysdig TRT has measured repeatedly in the wild.

For CISOs, the stakes have a number attached. According to ITIC's 2024 Hourly Cost of Downtime Survey, a single hour of downtime costs large enterprises over $100,000. For finance and healthcare, that number reaches $5 million per hour.

The 10-minute window isn't a security problem. It's a business problem.

Sysdig's 555 Benchmark Guide for CISOs breaks down what has to be true before an incident has any chance of operating at machine speed:

🔹 Runtime security exposed through APIs so AI agents can act without a human opening a dashboard
🔹 Unified telemetry across cloud, runtime, identity, CI/CD, and AI systems
🔹 Predefined, tested, and automated response actions that execute within the response window
🔹 Board-ready metrics queryable on demand, not assembled manually before every briefing
🔹 A materiality determination process that doesn't eat into your SEC four-business-day disclosure window

This guide is written specifically for security leaders. The practitioner edition is coming soon.

Download it here👇
https://okt.to/yCFVJM

09/02/2026

AI didn't invent new attacks. It just sped up old ones. 🔒

Crystal Morin's August Security Briefing is out, and this month's findings are worth sitting with.

A few things that stood out:

🔹 Ghostjacking turned AI coding agents into insider threats using a single log line. No new permissions required. Every step the agent took was something it already had authorization to do. That's not a vulnerability. That's an architectural problem.

🔹 A ransomware affiliate used Claude Code during intrusions across at least six victim organizations. When Claude refused to log into a live production system, the operator opened a new session, claimed authorization, and Claude moved forward.

🔹 ChainDrop, the latest evolution of the Shai-Hulud supply chain worm, poisoned over 400 packages and 2,000 versions in under four hours, specifically targeting AI coding tool credentials.

The assumption that a human is the final check before something executes in your architecture is gone. The audit that matters now isn't who has access. It's what someone's allowed to do once they're in, and whether anything stands between reading and taking action.

Read the full August briefing 👇 https://okt.to/07LwMh

09/01/2026

75% of organizations have automated response actions configured. Only 27% have them enabled.

That gap is a risk in itself. 🔒

Agentic threat actors don't pause for human decision. They move at machine speed, and defenses built around human review are already behind the clock before an analyst looks at the first alert.

The missing piece isn't more tooling. It's trust in the signal.

That's where stateful detections change the equation. Instead of flagging a single event in isolation, a stateful detection correlates a sequence of actions: opening a shell, downloading a binary to /tmp, executing it. The context that used to require a security engineer to reconstruct manually is built into the detection itself.

Higher fidelity signals. Fewer false positives. And once teams trust the signal, they trust the response.

The proof is already there: 140% more organizations are now automatically killing processes after a high-confidence detection. That's not reckless automation. That's what maturity looks like.
Read the full breakdown. 👇

https://okt.to/tDh0sF

08/31/2026

When Microsoft's Threat Intelligence team wants to understand JADEPUFFER, they call Sysdig. 🔒

Crystal Morin joined the Microsoft Threat Intelligence Podcast to break down the first documented case of an LLM conducting an end-to-end ransomware operation, what they found, how they proved it was an agent and not a human, and what it means for the threat landscape.

A few things worth pulling out:

🔹 When the agent hit a login failure mid-attack, it diagnosed the problem, rewrote 15 lines of code, and moved on in 31 seconds. No human can do that.
🔹 The ransomware specifically targeted AI file types: tensors, model weights, safe tensors. The crown jewels are changing.
🔹 "This lowered the barrier to entry for ransomware. All you need is an LLM to run it for you." — Crystal Morin

The good news: nothing in JADEPUFFER was novel. The TTPs were old. The vulnerabilities used for initial access should have been patched years ago. Basic security hygiene still works. The difference is you need to move at the speed the agent does.

Listen to the full episode👇 https://okt.to/BvzPLR

08/28/2026

AI security sounds intimidating. It doesn't have to be. 🔒

AI models run on the same cloud-native, containerized infrastructure security teams have been working with for years. The risks are familiar. What's missing is visibility.

An AI bill of materials extends SBOM practices to AI workloads: model weights, training pipelines, data provenance, dependency mapping. The same discipline, applied to a new set of artifacts.

AI is redefining your attack surface. You don't need to reinvent your security program to keep up.

Download the whitepaper👇 https://okt.to/JSLRgt

08/27/2026

Cloud security has been built around one assumption for over a decade: a human is always available to review alerts, correlate signals, and decide what to do next.

That assumption no longer holds.

Security teams didn't lose their edge. The window to use it collapsed. In 2018, attackers took nearly a year to weaponize a vulnerability. By 2023, it was eight days. By the end of 2025, hours.

The bottleneck isn't the quality of the dashboard. It's the assumption that a human has to be the one reading it.

That's the case our latest article makes, and it's worth reading whether you're already thinking about headless security or just starting to ask the question.

Read it here 👇
https://okt.to/74VPe5

Cloud security has been built around one assumption for over a decade: a human is always available to review alerts, correlate signals, and decide what to do next. That assumption no longer holds.

08/26/2026

Kubernetes 1.37 is available today with 67 enhancements. We dug through all of them and pulled the 19 that actually matter for security. 🔒

A few things worth knowing before you upgrade:

⚠️ Breaking changes:
🔹 SELinuxMount graduates to stable. If Pods with different SELinux labels share a volume, you may have issues.
🔹 Static Pods can no longer reference Secrets or ConfigMaps. That bug is fixed and the feature gate is gone.

🆕 New security features worth enabling:
🔹 Bind mount options (noexec, nodev, nosuid) on volumeMounts. Stop attackers from making malicious files executable on mounted /tmp volumes.
🔹 API server authentication to webhooks. kube-apiserver not authenticating to admission webhooks by default was a real gap. Now it can.
🔹 Kubelet rootless mode graduates to Beta and is on by default. Run kubelet as non-root to protect the host from container breakout.
🔹 Short-lived service account tokens for image pulls are now Beta and on by default. Simpler secret management, smaller blast radius if credentials leak.

The full breakdown covers all 19 changes with security implications, code examples, and what to do about each one.

Read it here👇 https://okt.to/DBNgcj

08/21/2026

Sysdig has been named to the inaugural Allied Defense 100 by Future Union, the first global ranking of private companies essential to democracy and allied defense. 🌍

Being included in the first-ever list alongside companies critical to global security is a recognition we don't take lightly.

It's also a validation of something we've believed from the start: that runtime intelligence and AI-powered cloud security aren't just enterprise problems. They're infrastructure-level capabilities that matter at a national and global scale.

As AI reshapes both how attacks are executed and how defenses must respond, the companies building that defense layer have never been more important.

Learn more about the Allied Defense 100 👇 https://okt.to/mtCnxd

08/19/2026

60% of containers live for one minute or less. ⏱️

By the time a traditional security scan runs, the workload is already gone. Posture-first tools weren't built for environments that move this fast.

Container and Kubernetes security done right looks different. It starts with three things:

🔹 Vulnerability management focused on what's actually running in production, not every CVE in the universe
🔹 Detection and response that operates continuously, not on a schedule
🔹 Compliance built for dynamic, ephemeral environments, not point-in-time assessments

The blog breaks down what each of these looks like in practice. And if you want to go deeper, the blueprint covers the full framework.

Read the blog and grab the blueprint. 👇
https://okt.to/Yk9PfG

08/17/2026

Dashboards only answer the questions someone already decided to build a screen for. Every other question waits. 🔒

That ceiling just got removed.

The SysQL Skill brings Sysdig's security graph into Claude Code so you can ask anything in plain language and get back live blast-radius data and a prioritized fix decision. No query language. No console. One conversation.

Here's what three questions looks like in practice:

🔹 "Find vulnerabilities with a known exploit." → Live results ranked by severity. CVE-2024-41110, a Docker escape at CVSS 9.9, sits at the top.
🔹 "How many workloads are affected?" → Zero direct workloads. The skill reasons through graph relationships, re-queries on its own, and finds three affected images on quay.io.
🔹 "Should I fix this? Find an available fix." → Yes. Exact fixed-in version for every affected image.

Three questions. One conversation. Fix decision done.

Read the full breakdown 👇
https://okt.to/PRaZok