Heimdal Security Blog

Most of the cyber incidents landing on our desks these days start with someone believing a lie. It’s not a brilliant piece of code that causes most breaches. A convincing email, a confident phone call, and a fake sense of urgency can make people hand over exactly what the attacker needs. Last week I talked to Aran Dharmeratnam about that, although he’s not a cyber security person. He built a career in the physical world, in risk intelligence and private investigations.

London, UK, 30 July 2026 – New data from Heimdal’s telemetry measures the gap between execution of the MediaArena adware and the completion of quarantine. The same pattern has been confirmed across more than 40 client environments. MediaArena is a browser-modifier adware family that Microsoft has tracked since 2023. It is low-severity, and that is what makes the finding notable. Even a nuisance-grade detection can finish establishing persistence before antivirus intervenes.

Heimdal did not start as a traditional cybersecurity company. It started with two Danish cybersecurity researchers, a piece of innovative technology and a challenge. Could they create something that could identify vulnerabilities, intercept malicious activity and help protect machines before threats could take hold?

“Make everyone one percent better and it compounds across the team.” That’s the line Joe Head wrote about his own job and when I read it back to him, he didn’t hesitate. “That is 100% the objective,” he said. Joe runs AI adoption for an 80-person team as the only AI automation specialist in the business. Part of the job is building automations, part of it is training people, and he protects that one-line philosophy from something most AI strategies never account for… the tool itself.

There are several cybersecurity companies that offer managed EDR services in 2026. Here’s what actually separates them, and who each one suits. Most successful cyber attacks begin with a breached laptop, a smartphone or a server. Over the past 15 years, endpoint detection and response (EDR) has gone from niche to a mainstream security solution. But managing that software, and triaging the alerts it raises, can be seriously time consuming. That’s where managed EDR services come in.

Without the right tools, no security operations centre (SOC) can do its job properly. A SOC platform brings together a range of security technologies that let your analysts rapidly identify threats, investigate them and implement fixes. There are many cybersecurity tools that an SOC can use, and there are many vendors selling comparable products. The choice of tools depends on the threats you face and your organisation’s maturity.

If Microsoft Defender quarantines BrowserModifier:Win32/MediaArena on one of your endpoints, the alert reads like a win. Our SOC data says treat it as a live persistence incident instead. In the case we timed, the payload finished writing its persistence 21 seconds into execution. Quarantine didn’t complete until 29 seconds. By the time the alert fired, the persistence was already on disk. We’ve seen this same adware cluster across more than 20 client environments in recent days.

There are several major managed detection and response (MDR) companies to choose from. We've compared the main offerings of the best MDR providers to help you decide which is right for your organisation. Maybe it was a near miss, or a security team stretched too thin and drowning in alerts from dozens of tools.

Your client is no longer just buying your security advice. They're auditing whether you live by it. That was a clear message from my exclusive interview with Heather MacDonald Alford, an MSP finance specialist and owner of Counting Creators. Heather's exactly the kind of customer MSPs should be paying attention to.

Your client is no longer just buying your security advice. They’re auditing whether you live by it. That was the clearest message from the exclusive interview I had with Heather MacDonald, an MSP finance specialist and owner of Counting Creators. Heather’s exactly the kind of customer MSPs should be paying attention to: informed, commercially minded, and willing to challenge vendors who cannot prove they practice what they preach. And this is where security culture is heading.