Loading…
Topic
3 posts about Threat Intelligence. Every summary links to the original.
See the idea
Application security is a closed loop: discover and prioritize risk, govern access and agent behavior, protect at runtime, then investigate and feed findings back into the next cycle.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.
Claude’s Safeguards team describes a lifecycle approach to reducing misuse while keeping the model useful, combining policy, training, evaluation, real-time enforcement, and monitoring. The team uses a Unified Harm Framework spanning physical, psychological, economic, societal, and individual autonomy harms, and policy vulnerability testing with external experts to shape policies and defenses. Before release, Claude undergoes safety, risk, and bias evaluations, including capability uplift testing in high-risk domains; findings can lead to new detection methods or guardrails. After deployment, prompted or fine-tuned Claude classifiers monitor violations for response steering and account actions, while human review and CSAM hash matching support enforcement. Ongoing analysis uses privacy-preserving topic clusters, hierarchical summarization, and threat intelligence to identify aggregate misuse and novel attacks.
Heroku frames security as an engineering discipline that must challenge happy-path assumptions, test continuously, and prepare for low-predictability, high-consequence “black swan” events. Its threat-modeling guidance focuses on challenging defaults, recognizing that attackers have resources and organizational support, and planning for unexpected failures such as a zero-day exploit. A control-plane instrument for Heroku Postgres detected privilege escalation to a superuser role, and the Data team isolated the instance within 17 minutes while investigating the activity. The event was traced to researcher Andrew Krasichkov (“buglloc”), whose testing exposed a vulnerability in the dblink and postgres_fdw extensions. Through the Bugcrowd bug bounty program, Heroku worked with him to understand the issue, reward the finding, and defend against the previously unknown flaw before a patch was available.
The best engineering reads, once a week.
