Securonix, Inc., today introduced Securonix Advanced Behavioral Analytics (ABA), a new capability that helps security teams identify at machine speed, activity that is technically permitted but operationally abnormal. ABA features Agent and Entity Behavior Analytics (AEBA), which identifies when an enterprise AI agent uses an unexpected tool, accesses data outside its purpose or changes its operating pattern. It connects those changes with identity, authority, data use, asset sensitivity, timing and threat context, helping analysts understand what changed, why it matters and what to do next.
Compromised accounts, insider activity and AI agents can resemble legitimate behavior when events are reviewed in isolation. Advanced Behavioral Analytics combines AEBA with User and Entity Behavior Analytics (UEBA), which connects unusual login times, rising data access and contact with sensitive assets across systems and time. Together, AEBA and UEBA help analysts investigate developing risk instead of isolated alerts and carry context through detection, investigation, case management and governed response. Policies, approvals and audit records remain visible and enforceable throughout the process.
Detect AI-Accelerated Attacks and Govern the Response
Traditional SIEM platforms were built to collect and correlate human and machine activity before enterprise AI agents became part of the attack surface. Securonix extends behavioral baselines and risk detection across users, identities, assets, applications, cloud environments and AI agents. It correlates signals across systems and time to surface compromised identities, unusual access, privilege misuse, sensitive data exposure and abnormal agent activity. An expanding catalog of AI-threat policies helps teams detect established attack techniques such as AI compresses reconnaissance, exploit development, privilege escalation and data movement.
Sam, the AI SOC Analyst, executes repeatable Tier 1 and Tier 2 work across triage, investigation, evidence collection and case creation. The Agentic Mesh coordinates AI-supported workflows, while Agentic Guardrails keep actions policy-bound, visible and auditable. Analysts review and approve consequential response actions. By completing repeatable work, Sam helps security teams absorb growing alert volumes and expand SOC capacity without requiring linear growth in headcount.
For authorized insider-risk investigations, the Securonix Insider Intent Agent adds contextual and corroborating evidence while preserving competing explanations. Analysts review each signal as part of the broader evidence rather than treating a message, search or behavioral deviation as proof of intent.
New Research Supports Critical Need For AI Governance Pressure
Securonix research found increased AI investment alongside continued questions about governance, trust and human accountability. For The Evolution of Cybersecurity Automation: Towards the AI-Governed SOC, Securonix surveyed 1,000 global cybersecurity professionals during summer 2026.
Survey findings show that cybersecurity teams want automation and AI to advance work inside clear approval boundaries. In the survey, 96% of respondents said cybersecurity automation is important to their organization, 49% said they use AI in behavioral analytics with human approval and 99.6% said their organization had increased its budget for AI in cybersecurity automation during the past year.
Investment has moved past experimentation. Security teams want AI to advance the work inside clear approval boundaries, with evidence they can explain and outcomes they can defend. The full report and methodology will be available in November.
Independent Assurance for Governed AI
Securonix has also achieved ISO/IEC 42001:2023 certification, the world’s first AI management system standard. The certification covers the management system used to govern AI across the Securonix product portfolio, including ThreatQ, and follows an external audit with no major findings. It provides independent validation of accountability, AI risk management and human oversight and can support customer due diligence across security, procurement and AI governance reviews. The certificate is available through the Securonix Trust Center.
Availability
Securonix Advanced Behavioral Analytics is available now.
AI Developer Tools Turned Malware Traps
Posted in Commentary with tags CloudSEK on October 8, 2026 by itnerdCloudSEK researchers have uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. The packages deploy a modified Windows remote-access trojan (RAT) capable of stealthy surveillance and remote control.
More concerningly, two malicious packages remained downloadable on npm as of October 8, despite being flagged as malicious.
Key findings:
An important technical finding: The recovered implant did not beacon during more than 12 minutes of controlled testing, consistent with anti-analysis protections. Its capabilities were established through analysis of the recovered binary and the subsequently published KNTRAT source code. No successful victim compromise was confirmed.
Why this matters: The campaign demonstrates how attackers can exploit the growing demand for AI developer tools to introduce malware through trusted software development workflows, potentially exposing developer workstations and corporate environments.
Full research report, technical analysis and indicators of compromise:
https://www.cloudsek.com/blog/nebula-fake-ai-sdk-npm-packages-windows-rat
Leave a comment »