https://research.mysticcyber.com/Recent content in Research on Mystic Cyber Researchhttps://research.mysticcyber.com/images/share-card.pnghttps://research.mysticcyber.com/images/share-card.pngHugoen-USThu, 22 Oct 2026 00:00:00 +0000https://research.mysticcyber.com/a-year-of-agent-assisted-attacks/Thu, 22 Oct 2026 00:00:00 +0000https://research.mysticcyber.com/a-year-of-agent-assisted-attacks/Eleven months after the first detailed account of an AI-orchestrated espionage campaign, agent-assisted attacks have become routine in threat reporting. A synthesis of what the year’s public reporting shows, and which defensive assumptions held up.https://research.mysticcyber.com/incident-reporting-clocks-cra-circia/Thu, 10 Sep 2026 00:00:00 +0000https://research.mysticcyber.com/incident-reporting-clocks-cra-circia/EU Cyber Resilience Act reporting begins September 11, and the U.S. CIRCIA final rule is expected soon. Together with existing SEC, NIS2, DORA and state requirements, many organizations will face several reporting clocks from one incident. How to prepare a single process that meets them all.https://research.mysticcyber.com/eu-ai-act-omnibus-use-the-time/Thu, 30 Jul 2026 00:00:00 +0000https://research.mysticcyber.com/eu-ai-act-omnibus-use-the-time/Days before the August 2 deadline, the EU’s Digital Omnibus pushed most high-risk AI obligations to late 2027. Organizations that were racing now have room to build the inventory, governance and security controls the obligations assume.https://research.mysticcyber.com/evaluating-ai-features-in-security-products/Thu, 25 Jun 2026 00:00:00 +0000https://research.mysticcyber.com/evaluating-ai-features-in-security-products/Nearly every security product now ships an AI assistant or agent, and the demos are impressive. The questions that show whether a feature will hold up in your environment, with your data and your team.https://research.mysticcyber.com/2026-dbir-exploitation-overtakes-credentials/Thu, 28 May 2026 00:00:00 +0000https://research.mysticcyber.com/2026-dbir-exploitation-overtakes-credentials/For the first time in the DBIR’s history, exploiting vulnerabilities is the leading way attackers get in. A look at what drove the shift, why faster patching alone won’t close the gap, and where exposure management should focus.https://research.mysticcyber.com/protecting-admin-planes-after-wiper-attacks/Thu, 23 Apr 2026 00:00:00 +0000https://research.mysticcyber.com/protecting-admin-planes-after-wiper-attacks/A destructive attack in March reportedly used a company’s own device management platform to wipe its devices. Admin planes can reach everything by design. Here’s how to protect them as the critical systems they are.https://research.mysticcyber.com/march-2026-supply-chain-wave/Thu, 09 Apr 2026 00:00:00 +0000https://research.mysticcyber.com/march-2026-supply-chain-wave/In a few weeks, attackers poisoned a security scanner, an AI gateway library and one of the most-used HTTP clients in JavaScript. The common thread was where those tools run, and what credentials sit beside them.https://research.mysticcyber.com/measuring-security-automation-value/Thu, 12 Mar 2026 00:00:00 +0000https://research.mysticcyber.com/measuring-security-automation-value/‘Hours saved’ is the most common way to justify security automation, and one of the least reliable. A set of measures that show whether automation is helping investigations, response and the team, with an illustrative example.https://research.mysticcyber.com/agentic-ai-governance-starts-with-access/Thu, 12 Feb 2026 00:00:00 +0000https://research.mysticcyber.com/agentic-ai-governance-starts-with-access/Agents are moving from pilots into daily work, and some are arriving without anyone deciding to deploy them. A practical starting point for governance: an inventory of the access each agent holds and the actions it can take.https://research.mysticcyber.com/2026-security-roadmap-leadership-will-fund/Thu, 15 Jan 2026 00:00:00 +0000https://research.mysticcyber.com/2026-security-roadmap-leadership-will-fund/Roadmaps get funded when they connect specific work to specific risks the business recognizes, in an order that makes sense. A practical structure for building one from the evidence you already have.https://research.mysticcyber.com/react2shell-framework-exposure/Thu, 11 Dec 2025 00:00:00 +0000https://research.mysticcyber.com/react2shell-framework-exposure/A maximum-severity flaw in React Server Components was exploited within hours of disclosure. The patch was straightforward. Finding every affected application across cloud accounts, hosting platforms and vendor products was not.https://research.mysticcyber.com/preparing-soc-for-machine-speed-intrusions/Thu, 20 Nov 2025 00:00:00 +0000https://research.mysticcyber.com/preparing-soc-for-machine-speed-intrusions/The first publicly documented espionage campaign run largely by an AI agent changes the tempo defenders should plan for. What the disclosure showed, what it didn’t, and how to adjust detection, triage and response.https://research.mysticcyber.com/when-your-security-vendor-is-breached/Thu, 23 Oct 2025 00:00:00 +0000https://research.mysticcyber.com/when-your-security-vendor-is-breached/A nation-state actor stole source code and undisclosed vulnerability details from a major network security vendor. For customers, the immediate work is patching. The longer-term work is deciding how architecture should account for vendor compromise.https://research.mysticcyber.com/shai-hulud-developer-credentials/Thu, 25 Sep 2025 00:00:00 +0000https://research.mysticcyber.com/shai-hulud-developer-credentials/September brought two major npm compromises in a week, one of them a worm that used stolen tokens to publish itself into hundreds of packages. An analysis of how it spread, and the controls that break the chain.https://research.mysticcyber.com/oauth-tokens-saas-integrations/Thu, 04 Sep 2025 00:00:00 +0000https://research.mysticcyber.com/oauth-tokens-saas-integrations/Attackers used OAuth tokens from a sales chat integration to export CRM data from hundreds of organizations, then searched it for more credentials. Most victims had strong login security. The tokens went around it.https://research.mysticcyber.com/toolshell-patching-was-not-enough/Thu, 31 Jul 2025 00:00:00 +0000https://research.mysticcyber.com/toolshell-patching-was-not-enough/The SharePoint exploitation wave stole cryptographic machine keys, so attackers could return after servers were patched. A timeline of the campaign, why key theft changes response, and what to check on any on-premises SharePoint farm.https://research.mysticcyber.com/designing-assistants-after-echoleak/Thu, 10 Jul 2025 00:00:00 +0000https://research.mysticcyber.com/designing-assistants-after-echoleak/A zero-click flaw in a major enterprise assistant showed how an email nobody opens can instruct an AI to send data out. A practical guide to the trust boundaries that retrieval-augmented assistants create, and the controls that hold up.https://research.mysticcyber.com/help-desk-is-an-identity-control/Thu, 19 Jun 2025 00:00:00 +0000https://research.mysticcyber.com/help-desk-is-an-identity-control/This spring’s retail and insurance intrusions started with phone calls to the help desk. Attackers convinced help desks to reset credentials and MFA. Here’s how to make the service desk a strong link in identity security.https://research.mysticcyber.com/2025-dbir-budget-decisions/Thu, 15 May 2025 00:00:00 +0000https://research.mysticcyber.com/2025-dbir-budget-decisions/Third-party involvement in breaches doubled. Ransomware showed up in more breaches even as fewer victims paid. Edge devices became a fifth of exploitation targets. What each shift should change in next year’s plan.https://research.mysticcyber.com/vulnerability-management-without-cve/Thu, 24 Apr 2025 00:00:00 +0000https://research.mysticcyber.com/vulnerability-management-without-cve/For about a day, it looked as if the system that names and tracks vulnerabilities would lose its funding. The contract was extended, but the scare exposed how many programs depend on a single upstream source. Here’s how to build in resilience.https://research.mysticcyber.com/bybit-theft-vendor-workstation/Thu, 06 Mar 2025 00:00:00 +0000https://research.mysticcyber.com/bybit-theft-vendor-workstation/The largest theft in cryptocurrency history didn’t break the exchange’s cold-wallet controls. It changed what the signers saw. The lessons apply to any organization that approves high-value actions through a vendor’s interface.https://research.mysticcyber.com/finding-the-ai-your-organization-already-uses/Thu, 06 Feb 2025 00:00:00 +0000https://research.mysticcyber.com/finding-the-ai-your-organization-already-uses/A new model topped the app stores in a week, and security teams were asked whether employees were using it. Most couldn’t answer quickly. Here’s how to build an AI usage inventory that keeps up.https://research.mysticcyber.com/proposed-hipaa-security-rule-program-plan/Thu, 16 Jan 2025 00:00:00 +0000https://research.mysticcyber.com/proposed-hipaa-security-rule-program-plan/The HHS proposal published January 6 would turn many long-standing ‘addressable’ safeguards into firm requirements. Healthcare organizations and their business associates can use the comment period to build a realistic plan, whatever the final text says.https://research.mysticcyber.com/edge-devices-front-door-2024/Thu, 12 Dec 2024 00:00:00 +0000https://research.mysticcyber.com/edge-devices-front-door-2024/VPN gateways, firewalls and management consoles produced the year’s most consequential exploitation. A review of the 2024 pattern, why conventional vulnerability programs under-weight these devices, and how to rebalance.https://research.mysticcyber.com/salt-typhoon-enterprise-communications/Thu, 21 Nov 2024 00:00:00 +0000https://research.mysticcyber.com/salt-typhoon-enterprise-communications/The telecom intrusions disclosed this month reached call records and lawful-intercept systems. For enterprises, the practical lesson is about where trust in a communications path should end.