SentinelOne

Track Shadow AI as Fast as It Spreads Your last shadow AI inventory was outdated before you finished writing it. Employees adopt AI the moment it's useful. They open a browser extension, paste documents into a personal account, and wire API keys into workflows on their own. Security catalogs the first wave. Three more have already shipped. A structured 30-day discipline catches each new wave as it lands. The 30-Day AI Security Quick Wins Checklist turns "discover and lock down" into an actual operating rhythm: - Week 1: Map every AI tool employees already use. - Week 2: Build visibility that updates in real time. - Week 3: Enforce protection where it actually matters. - Week 4: Build governance that scales as adoption grows. Security and AI adoption move together when visibility runs as infrastructure. That's the real quick win. Get the checklist: https://lnkd.in/ezJufsq8

🚨 This week, cybercrime hit global financial networks, Microsoft 365 environments, and regional law enforcement infrastructure. 🚦 The Good: Spanish authorities apprehended a core operative supporting pro-Russian hacktivists, while a massive global operation arrested over 5,800 suspects tied to transnational financial fraud networks. The Bad: The Forg365 phishing-as-a-service platform is actively targeting Microsoft 365 enterprise accounts, utilizing AI-generated lures and malicious browser extensions to ensure persistent, undetected access. The Ugly: Rival state-sponsored espionage actors from China and India successfully breached Pakistani police networks, deploying custom malware to systematically spy on both law enforcement and civilian users. This was the week in cyber. 🔗 Full technical breakdown: https://s1.ai/GBU9-Wk28

Engineered to secure your AI. Built to give you the S1 Advantage. Join SentinelOne at Black Hat, August 1-6, as we showcase the next generation of AI-driven defense. Stop by booth 2933 to: ✅ Test your hunting skills in Mortal vs. Machine and go head-to-head with the Autonomous SOC. See how Purple AI, Purple MCP, and Auto-Investigation help you detect earlier and respond faster. ✅ Step into the ThreatOps Challenge and prove your skills in: Endpoint, Cloud, AI SIEM, or Prompt. ✅ Attend ‘Blurred Lines’ and learn how how global conflict and weaponized AI are reshaping enterprise risk. Get more details here: https://lnkd.in/ejZvNTH5

China- and India-nexus threat actors have converged on a single Pakistani police force, seen as a rich source of intelligence for both nation-states. SentinelLABS latest research tracked multiple campaigns from February 2024 to April 2026. Balochistan Police sits at a vertex, the result of multiple threat actors setting their sights on the data the agency holds. China-nexus interest is most likely motivated by a rising concern for the safety of its nationals living in Pakistan. With a growing population of Chinese citizens situated in the China-Pakistan Economic Corridor (CPEC), ongoing terrorist attacks have left the PRC dissatisfied with Pakistani protection. Data from Balochistan Police would give the PRC direct insights on the safety of their nationals, cutting out involvement from a partner they no longer trust. India-nexus threat actors make up the opposite side of the pincer movement with their activities motivated primarily by the country’s long-standing conflict with Pakistan. For them, control over Balochistan Police networks means having invaluable visibility on how Pakistan manages their security posture as well as persistent access to civilian data. When multiple cyberespionage actors target the same law enforcement institution, the convergence signals the institution's value as a source of intelligence. While their motives are completely different, both China and India continue to keep an adversarial eye on law enforcement organizations like Balochistan Police, watching for more opportunities to take what they need from Pakistan’s digital intelligence terrain. Full report: https://s1.ai/spy2flags

US national AI infrastructure requires security controls designed for AI workloads. The US Federal Government is committing $600 million to build one of the world's most advanced AI infrastructure systems. Executive Order 14363, the Genesis Mission, connects national laboratory supercomputers across nuclear simulation, biodefense, and energy grid modeling. The security framework governing these workloads was not written for this scale of use. NIST SP 800-234 was designed for deterministic HPC workloads. Code that runs the same way, every time, and behaves predictably under well AI workloads operate differently. The framework has to match. This spring, three AI-driven supply chain attacks hit in three weeks: LiteLLM, Axios, CPU-Z. All arrived through trusted channels carrying payloads built to stay hidden. SentinelOne stopped all three on the day each launched. Behavioral detection reads execution patterns at runtime and acts on the break from baseline. Behavior is the decisive signal. A compromised model can be correct 99.9 percent of the time and adversarially wrong under precisely targeted conditions. The technology exists. It requires a shift in architecture. SentinelOne has submitted a formal proposal to the NIST HPC Security Working Group. NIST has acknowledged it. Read the full proposal → https://s1.ai/HPC-AI

Long-running AI agents have a memory problem. Every turn produces useful information, but the weight of that additional context creates noise and increases costs. The frontier labs answered with compaction. A summarization pass over prior agent actions that carries state forward without losing the key learnings. To test this important capability SentinelLABS applied OpenAI's compaction to our reverse engineering harness. The results were impressive: - Input tokens fell 86%. - Output tokens fell 31%. - Reasoning tokens fell 33%. Each run needed fewer model calls, but the aggregate evaluation scores stayed the same. This blog digs into what those numbers mean architecturally. Compaction pushes every developer toward the same decision: what lives in the context window, and what lives in retrievable storage? We land in a clear place. Working memory belongs in context. Evidence belongs in durable storage. Long-running agents were expensive and noisy to evaluate at scale. Compaction changes both, and it moves context engineering from a nice-to-have into the core of how these systems get built. https://s1.ai/CE-Compact

🚨 This week, cybercrime targeted unclassified government networks, encrypted messaging applications, and academic institutions. 🚦 The Good: Montenegrin and U.S. authorities apprehended an Iranian cybercriminal responsible for attacking over 150 American universities, while an alleged 19-year-old UNC3944 operative was extradited for orchestrating massive corporate breaches. The Bad: Russian state-sponsored threat actors are employing advanced social engineering tactics to steal Signal recovery keys, actively bypassing end-to-end encryption to access private communications. The Ugly: Unknown hackers successfully breached an unclassified legacy Department of Homeland Security information-sharing network, raising serious concerns regarding exposed intelligence and security preparations. This was the week in cyber. 🔗 Full technical breakdown: https://s1.ai/GBU9-Wk27

Call it what you want: Autonomous SOC, Agentic SOC, AI SOC. The vision is the same. The reality varies wildly by organization and by team. As we said 18 months ago, the Autonomous SOC is a journey, not a destination. A lot has changed in those 18 months. Some core foundational elements have not. The most autonomous systems operating at scale today work because of the doctrine, oversight structures, and defined conditions built around them. The AI is one layer of a much larger system. 18 months of real-world Autonomous SOC deployments confirmed this. Security teams doing that work are seeing it: → 75% faster investigations → 4x more threats handled → 42% fewer false positives 18 months ago, we mapped out the Autonomous SOC Maturity Model. Today we check in on where we are on the journey. Read the full blog: https://lnkd.in/eu3h6Z2f

Investigation capacity is the binding constraint of the modern SOC. On nights, weekends, and during surges, alerts queue and verdicts wait, analysts are stretched, and coverage drops. The June edition of Code Purple is live. Inside this newsletter: 🤖 Purple AI Agentic Investigations, Now for Every Customer: Zero-click. Fully autonomous. Always investigating. Purple AI closes cases in minutes with a complete evidence chain and human gates on your terms. 🔗 SentinelOne + Claude: AI activity is now native telemetry in your security platform. Real-time policy enforcement, full visibility, zero silos. 🛡️ Runtime Guardrails Inside Amazon Bedrock AgentCore: Prompt Security is now embedded inside AgentCore prompt injection detection, tool-use validation, and data leakage prevention built into the environment where your agents run. Read the full Code Purple newsletter here: 

Endpoints are where most attacks start. IDC measured what effective endpoint protection is worth. A new IDC Report measures what SentinelOne Singularity Endpoint delivers. IDC interviewed seven organizations across seven industries independently. Inside the report: - The 3-year ROI IDC measured among SentinelOne customers - Annual savings per organization, in dollars and analyst hours - Real-world drops in remediation time and false positive rates - Insights from customers who have deployed Singularity Endpoint and Purple AI Independent IDC research, validated across seven organizations and seven industries. Swipe through for the full breakdown. Download the Business Value Report: https://s1.ai/IDC-BV