SANS Cybersecurity Blog

Cloud security architect is an ever-evolving role that requires continuous learning, analysis, and improvement. As cloud services change, so do the threat models, capabilities, and recommended secure-by-design patterns. AI is also rapidly changing the way that cloud security architects perform their jobs, while adding pressure to quickly identify new cloud resources, attack surfaces, and recommended AI architecture patterns.

In June 2026, attackers poisoned more than 1,500 packages in the Arch User Repository. One of the interesting aspects of this attack was that the malware wasn’t in the applications themselves. It rode in on the build scripts, which pulled rogue dependencies that dropped a Rust infostealer and, on systems where they gained root, an eBPF rootkit that hid its own tracks at the kernel level. For a lot of IR workflows, this would look like a clean system.

Every weapon begins as an extension of the hand that holds it. The spear lengthened the reach of the arm. The bow sent the point flying without the throw. The rifle placed a man's death a quarter mile beyond his sight, and the aircraft carried that death across oceans. At each turn, the distance between the warrior and the wound grew wider, and yet one thing never moved: a human chose the target, and a human struck the blow.

Every year when Rob M. Lee and I stand on stage in front of the SANS ICS Security Summit attendees, I'm reminded that this event has never been about the stage alone. The presentations matter, of course. SANS brings together some of the brightest minds in industrial cybersecurity to share research, lessons learned, and hard-earned experience.

In the June 2026 episode of the SANS Stay Ahead of Ransomware livestream, we explored an often-overlooked aspect of cybercrime: the human beings behind ransomware attacks. We were joined by special guest Jon DiMaggio, who is a threat intelligence researcher and author of "The Art of Cyber Warfare." We discussed his unique approach of directly engaging with ransomware actors and the invaluable insights this methodology has produced. Jon brings a unique perspective to threat intelligence.

Early in my career, I watched a fellow SOC analyst spend hours trying to find file hashes in a web proxy's logs. But file hashes don't appear in web proxy logs. That’s not a supported parameter. The analyst wasn't incompetent  — nobody had ever mapped what that log source actually contained against what the detection use case required. The data was flowing, the tool was running, and the search was completely futile.

The short answer: If you’re new to Red Teaming, → SEC565: Red Team Operations and Adversary Emulation If you’re an experienced operator seeking advanced tradecraft, → SEC665: Advanced Red Team Operations If you’re a tool developer or aspiring Red Team Engineer, → SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control However, these three courses all work together: In SEC565, you learn to run operations In SEC665, you learn to operate in hardened environments...

Your environment is already running operators that you didn't hire, and in most cases that you can't even count. Autonomous reasoning agents look enough like legitimate operators to pass identity checks, carry valid tokens, and slip past the detections built for humans and service accounts. They are neither. They adapt, they scale, and they act at machine speed; the controls most organizations rely on were never designed for them.

As geopolitical tensions intensify, so does cyber risk. Both kinetic and cyber operations are integral to modern conflict, and retaliatory cyber activity often targets both military and civilian infrastructure. For CISOs overseeing industrial operations, a critical question emerges: Are we prepared if our organization becomes a target? Asset owners do not determine whether they are targets: adversaries do. CISOs, however, can control their level of preparedness and operational resilience.

Anthropic published a guide on May 27 for using Claude Opus (and other models) to find and fix vulnerabilities in source code, along with an open-source repo that implements it. The guide is worth reading because of how ordinary the workflow looks. It is not a demo of a model finding exotic bugs. It is a practical six-step loop for finding flaws in source code to find and eliminate vulnerabilities.