Binary Defense

Heading to BSides Columbus next week? So are we. The Binary Defense team will be on the floor November 6th, and we want to hear what’s keeping you up at night. Alert fatigue, stretched-thin teams, threats that show up at 2 a.m. on a holiday weekend. Bring the tough questions and we’ll bring straight answers. Stop by to see how NightBeacon keeps a human-first defense working for you around the clock, so your team can focus on what matters most. Columbus, let’s talk shop. See you there.

Good hats. Better conversation. Thanks to everyone who joined Binary Defense and @PaloAltoNtwks at Haywire in Plano yesterday. We dug into how AI-speed attackers are reshaping the SOC, swapped real-world stories, and sent every guest home with a custom felt hat from @McKinneyHatCo. Thank you to their team for fitting every head in the room. Defense is a team sport. Dallas showed up.

Quest Diagnostics just disclosed a breach of the portal healthcare providers use to order lab tests and pull results. Patient records were likely accessed, and operations kept running. That combination tells you something. Our CTO Jason Vest weighed in for HealthcareInfoSecurity: “That looks a lot more like data theft and extortion than traditional ransomware.” Test results, insurance details and portal credentials keep their value long after the breach is contained. Jason explains why labs are in the crosshairs and what that means for defenders: hubs.li/Q04CjW7c0

Automating security decisions with AI won’t always give you the best containment scenario. AI should inform, but humans still need to make the critical decisions.  That’s exactly how NightBeacon CMD operates. It provides the evidence analysts need to make an informed decision. But the analyst still owns the decision.  See how NightBeacon CMD works: binarydefense.com/nightbeaco…

A detection that never fires looks exactly like a well-tuned one. You wouldn't know the difference until it was too late. We gave an AI detection engineer one rule: prove the detection works against real data, or explain why it can’t. In one run it found a rule that could never fire, tuned a noisy one with evidence, and called an empty environment “not covered” instead of faking it. ARC Labs walks through the full run, including what it handed back to a human: hubs.li/Q04Cbs3S0

Attackers are using AI to move faster. Defenders can too. @HackingDave opened IANS New York on AI as a force multiplier. Not a replacement for analysts, but a way to do more with the team you have. See it in action with our team on the IANS NYC floor today.

Attackers used to need 15 minutes to get a foothold, and hours or days to get everything they were after.  They can now do it all in a few minutes.  AI is changing the game for attackers. Defenders need to adapt.  Hear the full breakdown from our CEO David Kennedy, Chief Strategy Officer Rafal Los, and TrustedSec's Ryan Macfarlane and Carlos Perez on how defenders are adapting in the era of AI enabled attacks: hubs.li/Q04Bz4Ly0

Most AI grades its own homework: reviewers see the model's answer, agree, and the agreement becomes training data.  In NightBeacon CMD, adjudicators commit their verdict before they ever see the model's.  Blind by design.  See it for yourself: hubs.li/Q04BhhGb0

Last weeks Citrix 0-Day laid an egg and your SIEM likely never saw it. Attackers hid a payload in a NetScaler crash log and dropped a forked RAT. ARC Labs has the IOCs, KQL hunts and YARA rules in our breakdown below. Read the full blog here: hubs.li/Q04B7yL_0