Intel reports, articles,
and press.

Cyber risk has moved from the deal table to the hold period. 80% of PE firms are hit during ownership, at $2.1M a time, and you cannot diligence your way out of a risk that changes every day you hold the company.

Every security vendor now claims agentic AI. Most have added a chat box to a dashboard. Here is what genuinely changes in security operations in 2026, what does not, and the six questions that separate an autonomous platform from an agent bolted onto someone else's stack.

Detection-as-code still leaves humans writing, tuning and retiring every rule. Autonomous detection engineering closes the loop: the platform observes what can be detected, proposes what should be, proves each candidate against your real data, and deploys only what adds value.

For two years the industry sold a SOC with no humans in it. It was never real. That is not a setback: it is the most clarifying thing to happen to security operations in years. Once you stop chasing the SOC that will never exist, you can build the one that should.

A synchronised disclosure cluster lands as one Oracle PeopleSoft zero-day claims victims across automotive, insurance and medical devices. A single compromised SaaS integration drains CRM data from security's best-known vendors. And verified admin credentials circulate for almost 74,000 FortiGate firewalls, with no new CVE at all.

A single Oracle PeopleSoft zero-day cascades into 100+ organisations including a US regulator. A CVSS 9.8 flaw turns Splunk, the defender's own eyes, into an attack surface with a three-day federal patch deadline. And a plugin-store supply chain harvests the AI API keys of nearly 70,000 developers.

Nearly 6 million cruise-line customers and 4.9 million telecoms accounts exposed, both starting with a phone call. The FBI warns law firms about fake IT-support calls. Iran-linked operators wipe recovery layers, not just production. Your helpdesk, your SaaS and your backups are now primary attack surface.

Two security products actively exploited in the same week. A self-replicating npm worm rips through GitHub and a major observability vendor. A municipal health system loses 1.8 million people's biometrics through a third party. And the DBIR confirms it: exploitation has overtaken stolen credentials as the number-one way in.

A certificate authority is socially engineered and Defender turns on legitimate software. An education SaaS giant is extorted over data claimed to cover 275 million users. And an authentication bypass in cPanel leaves 1.5 million internet-facing servers exposed. Almost nothing this fortnight began with malware on a laptop.

Three enterprises extorted through Salesforce in seven days, none of them encrypted. Microsoft's largest Patch Tuesday of 2026 lands with a SharePoint zero-day already being exploited. And CISA's Known Exploited Vulnerabilities catalog grows by eight entries in a week.

One poisoned open-source scanner cascades into a tier-1 network vendor and the European Commission. Ransomware at a single software supplier disrupts most Dutch hospitals. And a state actor turns thousands of home routers into a silent credential-harvesting layer.

An API authorisation flaw exposes 2.7 million benefits records over 24 quiet days. One hour of vishing access lifts 900,000 records from an identity-protection firm. And a commoditised iOS exploit chain with three zero-days spreads across multiple threat actors.

A healthcare IT breach runs undetected for eleven months before 3.4 million patients are told. Cloud keys stolen in last year's SaaS supply-chain theft unlock a petabyte-scale claim against a Canadian BPO. And 13 KEV additions in a fortnight span browsers, ICS gear and AI tooling.

A vishing crew compromises CarGurus, Wynn Resorts and Figure without a single exploit. France's national bank registry is read for 16 days with one stolen credential and no MFA. And a CVSS-10 Cisco SD-WAN bypass triggers a federal emergency directive with 48-hour deadlines.

A vishing crew talks its way past MFA at a Dutch telecom and reaches 6.2 million customers. Romania's national oil pipeline operator is breached via an infostealer on one admin's personal device. And Notepad++'s own update channel is hijacked by a state-sponsored espionage group.

72 million Under Armour records surface online, an extortion crew dumps SoundCloud, Crunchbase and Betterment data after failed negotiations, and 1.4 TB of Nike R&D walks out the door. Not one headline incident used encryption, and a state actor weaponised an Office zero-day in days.

A CVSS-10 HPE OneView flaw is botnet-weaponised the day CISA flags it. Ransomware takes down three quarters of a South Korean conglomerate's servers, putting 9.6 million accounts at risk. And a single phishing attack at a Canadian regulator ends with 750,000 investors exposed.

Blacklight's information-security management system has been independently certified to the ISO/IEC 27001:2022 standard, covering the full platform and managed SOC operations.

Blacklight has formally opened operations at the Dubai International Financial Centre's Innovation Hub, deepening its support for regulated industries across the Middle East.

Procurement just got simpler — Blacklight SIEM, SOAR and SOCaaS are now listed on the AWS Marketplace, with private-offer pricing and committed-spend drawdown for AWS customers.

The average SOC receives nearly 4,000 alerts per day. Two-thirds are never investigated. When speed determines whether a breach is contained or catastrophic, who — or what — should decide what gets looked at first?

Blacklight AI has been named "Top Vendor – Security Operations Platform" by the prestigious GEC Media Awards 2024 in Dubai.

Critical sectors across energy, water, telecommunications and transportation are prime targets for nation-state actors and ransomware crews. Mixed IT/OT, growing IoT and rising geopolitical tension demand a tailored defensive posture.