The IT Nerd

Abstract Security today announced a partnership with Netskope to provide joint customers the ability to bring detection directly into the data stream and to help eliminate indexing delays for more efficient threat detection.

Through this integration, Abstract Security and Netskope empower customers to simplify and optimize the collection, transformation, and analysis of Netskope One telemetry. By ingesting high-fidelity Security Service Edge (SSE) data directly into Abstract’s adaptive pipeline, joint customers can filter, enrich, and route critical security context to any SIEM, data lake, or analytics platform. This integration helps ensure that customers maintain full data sovereignty and deep visibility while eliminating the prohibitive costs of high-volume log ingestion.

Controlling data is key

Modern cloud environments generate massive volumes of security data. Yet most organizations still depend on legacy workflows where detection runs only after logs are ingested and indexed, forcing teams to trade visibility for cost and time. By the time analytics systems can query the data, opportunities to detect and respond early have already passed. Working together, Abstract Security and Netskope can help eliminate the “indexed” delay by bringing detection directly into the data stream. Benefits include:

• In-Stream Detection: Abstract analyzes Netskope Log Streaming data as it moves to identify anomalies, patterns, and potential threats in real time.
• Adaptive Enrichment: Add context such as identity, geo, and threat intel before data ever lands in a SIEM or data lake.
• Dynamic Routing: Send only relevant, high-value security events to downstream tools, cutting waste while enhancing insight.
• Seamless Integration: Lightweight deployment built in collaboration with Netskope.

The ROI from this partnership for customers includes:

• Immediate Visibility: Detect risks within the data flow, reducing mean-time-to-detection with a “shift left” operational workflow.
• Operational Efficiency: Solve the “data explosion” challenge and streamline SOC operations by reducing noise and lowering log ingestion/storage costs by up to 70%, all while maintaining the deep, SkopeIT™ metadata visibility required for forensic precision
• Actionable Analytics: Transform raw SSE telemetry into actionable intelligence. Leverage rich user, device, and data context to eliminate alert fatigue and drive accelerated, automated responses through high-confidence detections.
• Unified Architectural Agility: Replace fragmented legacy stacks with a single, adaptive streaming layer. Simplify your infrastructure by consolidating inspection and analytics into a high-performance architecture that scales without compromising latency.

Abstract specializes in delivering threat detection in motion as its platform fuses data pipelines, analytics, and AI-assisted enrichment into a single continuous stream so security teams can filter, shape, and act on events as they happen. Instead of blindly sending everything to storage, Abstract inspects, correlates, and detects on the fly, sending only what matters to SIEMs, data lakes, or response systems.

Abstract Security today announced the launch of its PAINT Partner Program. (Partnerships, Alliances, and INTegrations). The PAINT program is designed to empower resellers, MSPs, MSSPs, and technology integrators to deliver differentiated cybersecurity solutions and accelerate revenue growth through collaboration with one of the industry’s fastest-growing security innovators. 

Since emerging from stealth in 2023, Abstract Security has attracted global attention for its modern take on the security operations stack. The company’s platform decouples data sources and destinations, offering customizable pipelines, real-time analytics and an AI-powered assistant that simplifies threat investigation and detection across environments.  

Now, with the launch of PAINT, Abstract is formally extending its platform to a broader ecosystem of partners ready to bring these capabilities to market. 

Program Highlights 

The PAINT Partner Program is structured to support partners at every stage of growth, from emerging solution providers to global systems integrators. Key benefits include: 

• Competitive pricing models with very attractive margin structures. Abstract’s pricing offers predictability, making it easier for partners to maximize profitability while providing value to end customers. We adapt to your business model to provide cost-effective scaling without compromising performance. 
• Flexible deployment models, including SaaS, self-hosted, and region-specific cloud hosting 
• Joint go-to-market opportunities, such as co-branded campaigns, sales enablement, and events 
• Rep-to-rep sales collaboration and technical support to accelerate sales cycles 
• Access to the Abstract Intelligence Gallery, a curated marketplace with integrations from leading threat intelligence providers 
• Streamlined onboarding and enablement, including certification pathways and training for both sales and technical teams 

Innovatively Differentiated  

• Data Pipelines: Streamline data management with efficient pipelines for ingestion, processing, and routing of security data. Our pipelines reduce data complexity, making it easier for customers to extract actionable insights. 
• Real-Time Security Analytics: Our Analytics engine delivers real-time threat detection and monitoring, allowing your customers to quickly respond to security threats. This high-performance analytics capability meets the demand for fast, accurate data-driven security decisions. 
• Intel Gallery: Access to curated threat intelligence, providing your customers with a robust resource to reveal threats and stay ahead of those emerging. Abstract’s Intel Gallery helps customers boost their intelligence capabilities, positioning you as providers of cutting-edge security solutions. 
• Abstract LakeVilla: LakeVilla is designed to give you a reliable, cost-effective way to store and access historical data without the high price tag or slow performance of traditional SIEM solutions. It makes cold storage actually work for security teams – no more painful rehydration and no more expensive re-ingestion. 

Built for Channel-Led Growth 

The PAINT program reflects Abstract’s commitment to building a channel-first business model that rewards joint success. With multi-cloud availability, marketplace listings across AWS, Azure, and Google Cloud, and support for regional hosting in markets like the Middle East, partners can tap into new revenue opportunities across verticals and geographies. 

The PAINT Partner Program is open to qualified partners globally. Interested organizations can learn more and apply by visiting Abstract Security’s partner page. 

https://www.abstract.security/partners

Abstract Security, the pioneer in streaming detection and response, today unveiled its groundbreaking Shift Left strategy for security operations—bringing real-time analytics, correlation, and response closer to the source of data. Abstract’s new model empowers security operations teams to detect threats in stream, before data hits storage—not after the damage is done. 

Read more about the Shift-Left Detections Approach from Abstract Security: www.abstract.security/blog/shift-left-detections-with-abstract.  

Why Shift Left for Detection Matters 

Instead of analyzing logs hours after an event, Abstract enables security teams to detect and respond in the moment: 

• Real-time correlation across cloud, endpoint, identity, and SaaS sources 
• In-stream threat intelligence and asset context 
• Instantaneous detection logic execution, before data hits the SIEM or data lake 

The result: security operations that are not only faster, but smarter, leaner, and more effective. 

A New Standard for ROI in Detection 

Traditional detection requires pushing massive volumes of telemetry into SIEMs just to run rules—an expensive, delayed, and inflexible process. Abstract changes the economics of detection by running analytics in-stream: 

• Up to 70% reduction in SIEM ingestion volume 
• 4x faster detection using ready-to-deploy rules with no custom tuning required 
• Improved signal-to-noise ratio, enabling faster, more confident responses 

To learn more about how companies like Juul Labs are already transforming their journey with Abstract, visit https://www.abstract.security/abstract-canvas.   

Detection-as-Code, Powered by ASTRO

Abstract’s ASTRO team delivers constantly evolving detection logic and threat intelligence as code—built for real-time execution. ASTRO also treats DFIR as code, enabling live incident investigations, timeline reconstruction, and playbook automation directly in the stream. 

• No manual queries 
• No stale enrichments 
• No delays in response 

DFIR becomes just as fast and automated as detection itself. Learn More about the DFIR-As-Code from Abstract in their blog series here. 

A Shift Worth Making 

Abstract’s Shift Left philosophy offers security teams a chance to modernize without overhauling. You don’t need to rip and replace. You just need to move detection to where the action is—before the threat moves past you. 

Abstract Security and SentinelOne have joined forces to deliver a powerful new integration between Abstract’s real-time security data pipeline and SentinelOne’s AI-powered Singularity Platform—reshaping how security teams detect, analyze, and respond to threats. 

This partnership addresses one of cybersecurity’s biggest challenges: how to find true threats in a sea of irrelevant data. Together, Abstract and SentinelOne® provide a scalable, intelligent solution that filters out noise, reduces cost, and accelerates response times across the enterprise. 

The Power of Two: Intelligence at the Edge, Clarity at the Core 

SentinelOne brings market-leading autonomous protection to endpoints, cloud workloads, and identities—combining behavioral and agentic AI, real-time threat detection, and automated response across the attack surface. With Singularity AI SIEM, organizations gain fast, searchable access to ‘hot’ security data—critical for reducing MTTD (mean time to detect) and MTTR (mean time to respond). 

Abstract Security complements this with a streaming-first, AI-enhanced data pipeline built specifically for security use cases. It ingests from any source, normalizes data to open standards (OCSF), applies advanced filtering, and routes high-value data into the Singularity platform. 

What This Partnership Delivers 

• Noise Reduction at Scale 
  Abstract filters out irrelevant data before it reaches SentinelOne’s Singularity™ AI SIEM, removing noise and reducing alert fatigue. 

• Real-Time Analytics and Threat Detection 
  By combining Abstract’s in-stream threat enrichment with SentinelOne’s threat detection capabilities, teams can detect and respond to threats faster and with greater accuracy. 

• No-Code Integration & Easy Migration to SentinelOne 
  With Abstract’s easy to use drag-and-drop pipeline creation, security teams can deploy in minutes without engineering effort and migrate from legacy SIEMs to SentinelOne’s Singularity™ AI SIEM with zero downtime—thanks to prebuilt connectors and automatic data normalization. 

• Unified Security Architecture 
  Together, the platforms create a streamlined, modern security stack—eliminating data silos, blind spots, and manual workflows. 

Why It Matters Now 

Organizations are under pressure to reduce risk, lower costs, and modernize outdated security infrastructure. This partnership offers a practical, high-impact path forward—unlocking value from existing data and enabling security teams to operate at machine speed. 

For security teams looking to move beyond the limitations of legacy SIEMs, this opportunity delivers a modern security operations platform built for today and ready for what’s next.

Abstract Security, the leader in streaming-first security data operations, today announced Juul Labs, a leader in consumer electronics manufacturing, as a new customer.  

In an industry long burdened by operational complexity and rising costs, Juul Labs is transforming its approach to cybersecurity and IT infrastructure. Under the leadership of Pablo Quiros, VP & Global Head of Security and Information Technology / CISO, the company has quickly improved its security posture by using modern platforms including Abstract Security to get real-time visibility, reduce complexity, and empower the existing teams so they can focus on real threats without noise. 

When Pablo Quiros joined Juul Labs, the company faced a complex and fragmented security environment. With a lean, high-impact team and no room for complexity, Quiros recognized the need for a solution that could provide powerful security capabilities without requiring a massive headcount or heavy operational lift.  

Security Without Compromise: Innovation at Speed and Scale  

After evaluating the market, Juul Labs chose Abstract Security for its modern approach to security operations. With built-in data pipelines, streaming threat detections, and native cold storage through LakeVilla, Abstract is designed from ground up to cut complexity, speed up response, and boost team efficiency — all without the overhead of traditional solutions.  

Immediate Impact, Measurable Gains  

With Abstract, Juul Labs now enjoys:  

• Full visibility across its entire attack surface – Juul now has “full understanding of our attack surface — who, what, where, when, and why.”  
• 4x engineering efficiency — “What previously took four days can now be done in a single day, freeing up engineering time for high-value tasks,” said Quiros. 
• Projected 75% infrastructure savings – Juul expects infrastructure costs to drop by up to 75% over the next year as legacy systems are phased out.  

A Platform for What’s Next – Rethinking Security for Modern Architecture  

Juul Labs is now expanding its use of Abstract Security to include advanced analytics, which enables its team to increase capacity without increasing headcount.  

Quiros sees Abstract Security as more than a platform — it’s a strategic partner. “We like that Abstract is young and responsive. We feel like we have a voice in shaping where the product goes.”   

Read More about Juul Labs’ story here www.abstract.security/blog/how-juul-labs-rebuilt-its-security-operations-using-abstract.

Abstract Security, the leader in streaming-first security data operations, today announced the release of LakeVilla, a cloud-native cold storage solution built for long-term security telemetry retention that delivers compliance-ready, highly accessible storage at a fraction of SIEM costs—without compromising on performance or accessibility.

Fully integrated into the Abstract Security Platform, LakeVilla enables organizations to retain and replay years of security data—instantly searchable and seamlessly usable across detection, investigation, and compliance workflows. LakeVilla provides: 

• Instant Searchability Without Rehydration: Data is always query-ready—no rehydration, no delays, no hidden fees. 
• Replay on Demand for Deeper Insights: Replay archived data through live workflows to uncover missed threats and refine detection. 
• Cost Savings at Enterprise Scale: Reduce storage costs by sending only frequently accessed, high-touch data to analytics engines—while routing the rest to LakeVilla for affordable, always-available retention. 
• Seamless Integration with Abstract Pipelines: Removes redundant ingestion steps and ensures seamless data flow from real-time detection to long-term storage. 
• Cloud-Native Flexibility and Vendor-Neutral Design: Supports AWS, Azure, and GCP cloud object storage—giving organizations the flexibility to store data where they already operate with built-in flexibility to migrate without hassle and avoid vendor lock-in. 

Why have a Lake House When You Can Have a Lake Villa! 

While data lake architectures are often bloated, costly, and slow to access, Abstract Security’s LakeVilla is different: purpose-built for security, optimized for speed, and seamlessly integrated with the tools teams already use. It’s not just a storage location—it’s an operational asset. 

Availability 

LakeVilla is available now for all Abstract Security customers in both hosted and private cloud deployments. To learn more, check out the LakeVilla blog. 

Abstract Security today announced the launch of ASTRO (Abstract Security Threat Research Organization), aimed at redefining how companies detect, understand, and counter the most sophisticated cyber threats of the 21st century. ASTRO was formed by a coalition of cyber defenders, threat hunters and incident responders that have spent decades responding to real world incidents.

ASTRO provides high-powered capabilities to customers across the Abstract Platform by:

• Delivering Filtering, Aggregation, Transformation and Enrichment actions (FATE),to surface the signals that matter most, empowering analysts, defenders, and cyber operations teams to move faster and smarter.
• Embedding Abstract Security Engineer (ASE), the company’s advanced intelligence engine, with the team’s expertise to empower security analysts. Abstract utilizes the latest advancements of GenAI, machine learning, expert systems and automation for this critical capability.
• Detecting the latest risks and threats with Abstract’s Streaming Threat Detection Engine with criteria covering the entire attack surface of Cloud, SaaS, Network and Endpoint.
• Integrating data sources and destinations with Abstract Security’s Platform, to collect the most relevant events, context and data to provide the most complete situational awareness.

Abstract’s ASTRO team have played pivotal roles in the evolution of threat intelligence and response — beginning their careers at organizations such as CERT.org and NCFTA to leading positions at Equifax, Blackberry, Palo Alto Networks Unit 42, the Secureworks Counter Threat Unit, Sumo Logic, and Anomali. This collective experience fuels ASTRO’s mission “to protect the future by pioneering all-source data, threat, detection, and response analytics across today’s most critical environments.”

Abstract’s ASTRO team provides customers with insight into all the thousands of IoT/smart devices that connect to the network plus the entirety of SaaS software applications to make sure they are detecting everything happening in order to locate the bad actors and nefarious activity. ASTRO embeds the Abstract Security Engineer (ASE) technology to utilize GenAI and machine learning technology as well as providing expert systems and automation to train ASE with the team’s vast experience in all things cybersecurity.

For additional insight, please see ASTRO’s latest blog: The Invisible Enemy: Unmasking Microsoft 365’s Logging Blind Spots.

In today’s hyperconnected world, cybersecurity professionals face an unprecedented challenge: managing an overwhelming flood of security data. According to recent research by the Enterprise Strategy Group (ESG), nearly half of cybersecurity and IT professionals say handling security data has become significantly more difficult in just the past two years. With every endpoint, server, application, and network device generating endless streams of logs and alerts, security teams are caught in a rat race—drowning in information yet struggling to detect and mitigate real threats efficiently.

The root cause is an expanding attack surface driven by cloud adoption, remote work, and the rapid proliferation of IoT devices. This ever-evolving threat landscape results in fragmented data sources, performance bottlenecks, and compliance challenges. Most organizations rely on multiple security repositories such as SIEM, XDR, NDR, and EDR platforms—creating visibility gaps and making security operations more complex than ever.

Abstract Security, along with several other industry leading authors, is have published an eBook entitled Applied Security Data Strategy. The book contains chapters including:

• Data: The New Oil, Refining the Future
• Data Discovery
• Data Collection & Ingestion
• Data Processing
• Data Storage
• Data Analysis
• Data Reporting
• Data Governance and Security
• Understanding Common Data Platforms and Tools
• Time to Build Your Own Security Data Fortress

Industry authors include:

• Alan Czarnecki
• Alex Gilelach
• Ryan Moon
• Matt Carothers
• Paul Keim
• Don Mallory
• Greg Olmstead
• Jon Oltsik
• Justin Borland and Aqsa Taylor from Abstract

You can have a look at the eBook here.

Abstract Security announced today that it has partnered with Analytica42 to help organizations easily integrate their data sources with Google SecOps platform for analytics and storage. With the new integration, Abstract Security makes it easier for customers to migrate to Google SecOps through its pipeline management features which eases the burden of data management and routes quality data to the platform. 

Abstract provides over 100 integrations for data sources with industry-leading vendors out of the box, in addition to threat intel feeds and its own in-house ASTRO threat feed. This comprehensive ecosystem enables customers to blend their unique security data with valuable threat intelligence and insights, significantly enhancing their overall security posture and enabling more informed decision-making. Further, Abstract offers customers a fully hosted solution on Google Cloud Platform or the flexibility to deploy into their own cloud environments, giving them complete control over their cybersecurity infrastructure.

Abstract’s security operations platform delivers analytics that quickly correlate data and delivers actionable insights at the business level, ensuring security teams can focus on what matters most. With Abstract’s data pipeline management tool, customers benefit from Abstract’s ability to decouple the data sources from data destinations and normalize the data in real time before it reaches a destination. Through this tool, Abstract removes dependency and makes data easily routable to any destination which saves time and money for data storage.   

Abstract has chosen to work with Analytica42 as a global delivery partner to ensure that the transition to a new environment is seamless with as little disruption as possible.

Analytica42 offers many years of experience in the integration and migration of security tools to and from a wide range of SIEMs. This enables customers to unlock their SIEMs full potential, ensuring faster detection, quicker response times & more streamlined workflows. Rather than just simply adopting a one-size-fits-all approach, Analytica42 takes the time to understand the specific requirements, utilizing a comprehensive, pre-built library of use-cases alongside more bespoke solutions to minimize false positives & ensure you have full visibility across your security landscape. 

Abstract Security today announced it has added support for deployments within Google Cloud Platform (GCP). 

The support for GCP follows Abstract Security’s existing support for AWS and Azure. Abstract enables multi-cloud deployments of its SOC platform, deploying multiple instances of Abstract Security around the world to support data localization requirements and eliminate data transfer costs. Additionally, Abstract supports transactions through both AWS and Azure marketplaces with GCP coming soon.

Abstract Security’s SOC platform offers:

• Seamless integration with local GCP services – Ensuring strong security coverage and visibility into GCP services. 
• Abstract Intel Gallery – As part of Abstract’s data fabric, organizations can leverage no-code ETL to enrich events with real-time threat intelligence, enhancing detection accuracy and relevancy. 
• Real-time streaming threat detection – Security analytics are powered by AI, enabling enterprises to stay ahead of rapidly evolving cyber threats. 
• Compliance and data sovereignty – Providing a single search and reporting view across regional deployments, enabling compliance with data localization requirements.

Abstract has seen growing demand since emerging from stealth and announcing its Seed funding in March 2024. In April, Abstract announced the opening of its first Middle East office. In May, the company announced the addition of Christopher Key to its Board of Directors and was selected as a “Pioneering Cybersecurity Startup” winner, as part of the 2024 Global Infosec Awards.