Archive for October 20, 2026

Abstract Expands Its Agentic SIEM: Security-Focused Models, Real-Time Triage, Response on Every Detection

Posted in Commentary with tags on October 20, 2026 by itnerd

Abstract today announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract’s own trained and tuned models and frontier foundation models, and SOAR response capabilities with actions assigned directly to detection rules. The capabilities are built into the platform that already collects, routes, and detects on security data in stream.

Security teams are facing agentic attacks that move at machine speed while their own tooling spreads the response across a pipeline vendor, a SIEM, a SOAR, a threat intelligence feed, and an AI triage bolt-on. Dozens of AI SOC vendors sell agents that sit on top of someone else’s alerts and add another contract to the stack. Abstract runs the entire loop on one platform: 400+ integrations feed streaming detection that operates in real time, before data lands, findings combine into entity-based insights, and the SIEM itself now investigates, classifies, and responds on the same data plane.

Most AI bolted onto the SOC re-enriches the same alert from scratch every time it looks at one. Abstract’s pipeline builds an enterprise context layer that makes the data AI ready before the alert ever fires: events are normalized and enriched in stream with identity, threat intelligence, and asset context. That normalization gives AI the security semantic layer it needs, so a field like src is never confused between the sender of the data, the host that opened the connection, or the internal host another source means by it, and every investigation starts from context the platform already trusts.

The agentic SIEM works every alert in the queue. Alerts that once aged out or got closed in bulk to keep the queue moving now each get an investigation with evidence attached, and analysts review conclusions instead of raw alerts.

The new capabilities span the full security operations loop:

  • Investigation and triage run on a combination of Abstract’s own proprietary trained and tuned models and frontier foundation models. The ASTRO threat research team trains Abstract’s models, baking the team’s real-world intelligence into the artificial intelligence of the platform and keeping investigations current with the latest threats the team tracks in the field.
  • Real-time classification. Abstract’s models return triage decisions in real time, keeping analysis moving at the pace of the stream and feeding response actions while activity is still underway.
  • Threat hunting runs on the same data plane as detection and investigation, across the identity, cloud, endpoint, SaaS, and network data already flowing through the platform.
  • SOAR capabilities. Automated response is built into the platform, with containment, enrichment, and notification actions firing the moment a detection matches.
  • Investigations Astro runs today include threat intelligence detections, endpoint agent analysis, insider risk analysis, phishing and suspicious mail triage, and cloud attack analysis.

Where foundation models trained on the open internet bring broad knowledge and unvalidated confidence, Abstract’s models ground each assessment in the ASTRO team’s validated threat expertise, so verdicts reflect how attacks actually unfold rather than how they read in public write-ups. Foundation models handle the deep reasoning on cases that warrant it, with the full evidence trail preserved.

Availability

The new AI SOC capabilities are generally available today as part of the agentic SIEM. Investigation bundles are available as add-ons sized by alert volume. Existing customers can add investigation bundles through their Abstract account team. Details at https://abstract.security.

Human Behavior Simulation Platform Vectorial raises $3M to help companies launch successful products, the first time

Posted in Commentary with tags on October 20, 2026 by itnerd

AI is making building and launching products exponentially faster, but current user research is still painfully slow, expensive and biased. Even with AI-moderated interviews, getting user feedback from 50 – 100 participants still takes days, which is slow when you’re iterating on your product’s development and launch in hours. So companies skip user research at many important steps, which leads to AI slop.

Vectorial believes the next frontier in user research is every company having a living model of its target customers, modeled after thousands of customers, that keeps up to date with new emerging behavior and offers speed, breadth and depth in user research.

The company today announced a $3 million seed round backed by Industry leaders and institutional investors (Smilegate, SenseAI Ventures) and UC Berkeley ecosystem (Berkeley SkyDeck, Berkeley AI Research Lab), Stanford-led funds (Stanford GSB fund, Dent Capital) with participation from product leaders from Meta, Shopify and Mastercard. The round reflects the company’s deep academic backbone with AI ecosystems of Stanford,  StartX, CMU (Venture Bridge) and UC Berkeley.

The founders of Vectorial are making a bold bet: within four years, running a behavior simulation with audience models before building or launching a consumer product or agent will be the norm. Simulations have been common in the aerospace, manufacturing and chip industries, yet the consumer products that touch billions of people still launch on gut instinct and a few experiments with live users.


Vectorial’s human behavior simulation platform for software products and digital experiences lets product, design and marketing teams watch their model of target customers react to a product journey, campaign design or AI agent before a single real user touches it. These modeled users are powered by SAPIENS, a behavior model that learns the latent traits (socio-demographic, psychographic and behavioral traits) of the target customer. It is 30 percent more accurate in predicting behavior than general-purpose LLMs, outperforms academic behavior models such as Be.FM and Centaur, and is validated against real-user studies. Vectorial has already modeled more than 2.5 million real people and run more than 30,000 simulations.

Existing leaps in user research fall short. AI-moderated interviews have become the norm, but every new question means a multi-day study with a handful of participants, which is slow, expensive and biased. At the other extreme, simulated user agents answer instantly but use synthetic users with no grounding in real behavior data, which doesn’t build trust with customers. Other simulation companies focus on market research to support strategic decisions, but they don’t help with downstream decisions or put users inside the product development and launch loop. By contrast, Vectorial’s audience is grounded in real behavior data at massive scale and fits inside the product development, launch and build workflow.

Vectorial’s founding team comes from Stanford, CMU, ISB and BAIR, with deep domain expertise in understanding and modeling behavior and how it applies to business today. Taran has spent a decade modeling human behavior, including in defense research and research labs. Rahul, who launched multiple products at unicorn companies, worked on a behavior graph for sales at his last startup, and Jasmine led synthetic user for marketing at Pfizer.

Vectorial’s customers span healthcare, gaming and e-commerce and include public companies and billion-dollar enterprises serving enterprises across the globe – like MIDI health, GoodRx, Suki AI , Boat, Everkind, Concrete software and many more .. Customers run around 600 simulations a month (40 users studies/ month), 20x more research than before, and simulations have reproduced prior user-study findings with more than 85% accuracy.

Vectorial will use the cash raised to expand its behavioral datasets through new data partnerships and advance SAPIENS 2.0 to become the de facto generative simulation infrastructure for building and launching products.

Other World Computing (OWC) Announces 2026 Holiday Gift Guide

Posted in Commentary with tags on October 20, 2026 by itnerd

Other World Computing today announced its OWC 2026 Holiday Gift Guide lineup of storage, memory cards, connectivity, and accessories.

For any ​​creative professional, content creator, tech enthusiast, and/or power user, these innovative workflow solutions are sure to please:

  • OWC Thunderbolt 5 Dock with Dual HDMI – One connection provides the displays, storage performance, networking, power, and connectivity of an enterprise-class desktop workstation – without the need for a pile of adapters and workarounds
  • OWC USB4 Hub – 6-port USB4 essential connectivity solution with two USB4 downstream ports, two USB-C ports, an HDMI® 2.1 display output, and up to 81W of laptop charging through a single USB4 cable
  • OWC Thunderbolt 5 Dock – All-in-one command center for eliminating cables, expanding ports, and maximizing performance at your desk
  • OWC Thunderbolt 5 Hub – Compact port expansion hub that turns one ThunderboltTM 5 connection on your computer into multiple high-speed ports
  • OWC Express 1M2 – Ultra-fast, compatible, and reliable portable USB4 NVMe SSD – build your own or choose ready-to-run solutions
  • OWC Express 1M2 80G – Supremely fast, widely compatible, and highly portable Thunderbolt 5-compatible USB4 NVMe SSD – build your own or choose ready-to-run solutions
  • OWC Atlas Core CFexpress 4.0 Type B Memory Card – Serious photography and video capture made affordable
  • OWC Atlas CFexpress Card Reader for Type B and A – Ultra-fast compact USB4 (40Gb/s) CFexpress 4.0 Type B card reader for creative professionals – includes Type A to B adapter for fast ingest of Type A cards
  • OWC Thunderbolt 5 (USB-C) Cables – Fastest, most compatible cable for connecting today’s, tomorrow’s, and yesterday’s Thunderbolt and USB-C devices
  • OWC USB4 40Gb/s Active Optical Cables – Transmit data at full USB4 speeds over fiber optic cable with the 3M cable supporting 240W power delivery and the 5M cable supporting 60W power delivery
  • OWC 72-Piece Advanced Toolkit – All you need to service or repair your computer, tablet, or other small device – use it on your Apple, PC, Chromebook, gaming, or printer/copier devices

The 2026 OWC Holiday Gift Guide can be found here: https://www.owc.com/holiday-gift-guide.

Want to get a closer look? OWC will be showcasing its 2026 Holiday Gift Guide roster at Pepcom’s Holiday Spectacular, taking place on October 28, live in New York City and livestreamed. To learn more, please visit https://www.pepcom.com/.

ConnectWise disables cloud applications after attackers access customer environment

Posted in Commentary with tags on October 20, 2026 by itnerd

ConnectWise has disabled affected cloud applications after attackers used a compromised vendor credential to gain unauthorized access to customer Microsoft 365 environments, according to a Saturday blog post.

Huntress identified nearly 1,000 Microsoft Entra tenants with suspicious sign-in activity, including more than 300 successful sign-ins. In one customer environment, a ConnectWise application obtained Global Administrator privileges and added unauthorized credentials to other applications, including a Huntress security application.

The activity involved ConnectWise Cloud Backup, formerly SkyKick, and cloud management applications for Microsoft Teams, Exchange and SharePoint. Huntress warned that disabling affected applications does not remove credentials already added by attackers. The full extent of data access remains under investigation.

Denis Calderone, Principal / CTO, Suzu Labs:

“ConnectWise just showed why an approved Entra app has to be treated like standing privileged access. App-only identities sit outside the controls you built for people. No user, no device, no MFA prompt, and revoking user sessions does nothing. The vendor secret is a master key to every tenant that already approved the app, and a lot of what it can read through Graph never shows up in the audit log, so it’s hard to know when it’s being abused. In at least one tenant a ConnectWise application granted itself Global Administrator and planted new secrets on other apps, including Huntress’s own security application. Disabling ConnectWise does not pull those extra keys.

“They pointed the stolen publisher secret at those tenant IDs. That’s it. Cloud Backup is a multi-tenant application, so the credential lives in ConnectWise’s tenant and works against every customer where an admin already approved the app. All they did was present the secret, name a tenant, and Entra issues a Graph token if the service principal is there. If the app was never “consented,” the attempt fails. The other wrinkle is leftover approvals. Todyl saw successful sign-ins in tenants that had no active backup subscription. You can have a leftover SkyKick approval sitting in Entra from an old MSP relationship even if nobody has used the product in years. The attacker does not have to know your vendor stack; they just have to try the key and see what they get back.

“I would advise anyone with ConnectWise to hunt for the extra keys and disable the seven ConnectWise and SkyKick apps Huntress listed if found. Do not delete them though. Instead pull service principal sign-ins from October 13 on, not user sign-ins, and look for 144.172.64.0/24 addresses. I’d also suggest reviewing client secrets and certificates on every enterprise application added since October 13, starting with MSP tools and security tools. Check the Entra audit log for service principals adding themselves to directory roles. It’s probably also a good idea to hunt mailbox forwarding, inbox rules, and delegated access the same way you would after any mailbox compromise. Do not re-enable anything until ConnectWise confirms those credentials have been rotated. If you find a secret you did not create, assume they still have a way in.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“I’m really, really not impressed with how ConnectWise has handled this incident so far. It doesn’t feel like they’ve been open enough about what happened. They keep emphasizing that backup data wasn’t accessed, but if you look at the Huntress report, the concern goes well beyond stored backups. What else could the attackers access? Compromised application credentials can let attackers into customer tenants and give them access to data through Microsoft Graph. Customers need a clear explanation of that exposure.

“I think whoever is handling communications at ConnectWise is dropping the ball. We see this with too many organizations. They think carefully worded statements and splitting hairs will make things better. In my experience, the companies that come out better are the ones that explain what happened, what they know, what they don’t know, and what customers can do to protect themselves.

“ConnectWise needs to understand that we’re in the middle of the SaaS apocalypse. Customers have options. They can move to another vendor, replace a service, or increasingly build something themselves. Your technology alone isn’t going to keep them around. What matters more than anything is trust.

“Trust isn’t about doing everything right. It’s about how you represent and conduct yourself when things go wrong. ConnectWise can do better. They can recover from this, but that requires changing how they communicate and act moving forward.”

If you have ConnectWise, you need to take action ASAP as the bad guys are absolutely hunting for you to get access.

NordPass launches Identity Masking and ID Monitoring

Posted in Commentary with tags on October 20, 2026 by itnerd

NordPass is launching Identity Masking and ID Monitoring features to strengthen user identity protection.

Identity Masking, available for Premium, Family, and Business users, allows individuals to generate synthetic personal details for low-trust or unverified websites, protecting true identities from data harvesting and potential breaches.

Forced oversharing

Identity Masking enables users to generate coherent and usable synthetic names, home addresses, and email addresses (powered by Email Masking). These details can be used for newsletters, loyalty programs, and apps that demand extensive personal information without needing to verify a user’s actual identity.

Both Premium and Business users can create identity masks using the NordPass browser extension, desktop, and mobile apps. They can select to create either a male or a female name and pick from one of 12 locations for the address, including the UK, Australia, Brazil, Canada, and Switzerland. The information will look coherent enough to appear real, but will be deliberately engineered to prevent instances of impersonation.

The feature also offers a vital security layer for organizations. Employees often need to access third-party tools or free trials for work, which frequently require personal details. If this data is compromised, it can expose the employer. Identity Masking allows teams to test products and access resources securely while keeping their professional identities private.

Data Breach Scanner upgrade

NordPass also upgraded one of its trademark features, which users have already come to rely on — the Data Breach Scanner. From now on, Premium and Family users will be able to actively monitor not only their credentials, but also their most sensitive personal identification numbers, including SSNs, passports, and national ID cards.

Token Launches TokenCore™ Card: Proving the Person Behind Every Login and Critical AI Agent Action

Posted in Commentary with tags on October 20, 2026 by itnerd

Token today unveiled TokenCore™ Card at Authenticate U.S. 2026 (booth K4, Omni La Costa Resort & Spa). The biometric smart card brings FIDO2 passwordless authentication, on-device fingerprint verification, and Bluetooth and NFC into the card employees already carry. It gives enterprises phishing-resistant MFA for every user, from office staff to privileged administrators, and verified human approval for AI agents, working alongside the IAM, SSO, and PAM infrastructure they already run.

Attackers rarely break in anymore. They trick their way in – stealing credentials, intercepting codes, abusing MFA apps, or convincing employees to approve push requests and register, compromise or use passkeys that give the attacker trusted access. AI agents now act on credentials alone. Any factor that proves possession rather than presence works for whoever, or whatever, holds it. Security leaders need proof of the person, not just the credential.

TokenCore Card puts that proof in a familiar form factor. It will not authenticate without the enrolled user’s fingerprint, and the biometric never leaves the device – the signature does. Capabilities include:

  • Works with your existing SSO on day one
  • User setup is under 5 minutes
  • Passwordless login under 2 seconds
  • Wireless = 100% user acceptance
  • Works on every device: Windows, Mac, Linux, iOS, and Android
  • The true gold standard in identity
  • Biometric authentication for humans and AI agents

TokenCore Card also extends the AI agent approval capability Token introduced in June. When an agentic workflow reaches an action that matters, such as releasing a wire transfer or changing access rights, the action waits until the authorized person approves it with a fingerprint on their card. The same fingerprint that signs a person in approves their AI agents’ actions, and TokenCore integrates with AI agent gateways alongside existing IAM, SSO, and PAM systems.

See Token at Authenticate U.S. 2026, booth K4. Security and identity leaders can book an on-site briefing with the Token team at tokencore.com/contact.