Fal.Con 2026 · Las VegasLIVE NOWThreatHunt and ThreatContain revealed.See the announcements

SOC live

Partner sign inBecome a partner

Resources & insights

Field notes from
a 24/7 SOC.

Original analysis on the threat landscape, the state of managed detection and response, and the technology shaping how MSPs deliver security.

Featured · Threat Intelligence

CVE-2026-82329: Attackers Are Minting Admin Tokens in Artifactory Before Your Patch Window Closes

A critical JFrog Artifactory authentication bypass is being exploited to mint unauthenticated admin tokens, and those tokens outlive the patch. Here's the detection and containment gap MSSPs need to close.

Sep 2026 · 8 min read

CVE-2026-82329: Attackers Are Minting Admin Tokens in Artifactory Before Your Patch Window Closes

Sort by date

CVE-2026-8452: The NetScaler 'DoS Patch' That Was Actually Unauthenticated RCE

Threat Intelligence · Sep 2026

CVE-2026-8452: The NetScaler 'DoS Patch' That Was Actually Unauthenticated RCE

A NetScaler bug Citrix classified as denial-of-service in June turned out to be unauthenticated remote code execution, and CISA has confirmed active exploitation. Patching closes the door, but it doesn't check who already walked through it.

ShinyHunters Phished a ReliaQuest Employee. Device Trust Is the Only Reason It Stopped There.

Threat Intelligence · Aug 2026

ShinyHunters Phished a ReliaQuest Employee. Device Trust Is the Only Reason It Stopped There.

ShinyHunters phished a ReliaQuest employee, captured credentials and a live MFA approval, and still didn't get further in. ReliaQuest credits device trust, not training. Here's what that means for how a SOC should be built.

PaperCut's Two-Patch Week: What CVE-2026-82078 and CVE-2026-81578 Mean for MSSPs

Threat Intelligence · Aug 2026

PaperCut's Two-Patch Week: What CVE-2026-82078 and CVE-2026-81578 Mean for MSSPs

PaperCut's second emergency patch in 48 hours proves the ticket isn't the finish line. Here's what a partner's SOC should be watching for on every exposed Application Server.

CISA KEV August 2026: Why Decade-Old CVEs Are Suddenly Exploited Again

Threat Intelligence · Aug 2026

CISA KEV August 2026: Why Decade-Old CVEs Are Suddenly Exploited Again

CISA's August 26, 2026 KEV batch added six actively exploited vulnerabilities, one of them a decade old. Here's what that says about vulnerability debt and why detection has to work even when the patch list doesn't know an asset exists.

Ubiquiti's SAB-067: 22 UniFi Vulnerabilities, Three Rated CVSS 10.0, and a Patch Cycle MSPs Can't Outrun Alone

Threat Intelligence · Aug 2026

Ubiquiti's SAB-067: 22 UniFi Vulnerabilities, Three Rated CVSS 10.0, and a Patch Cycle MSPs Can't Outrun Alone

Ubiquiti's latest security bulletin patches 22 UniFi vulnerabilities, three of them maximum severity. For MSPs managing UniFi fleets across dozens of client sites, the patch cycle takes days. Here's what to do while it runs.

CISA's 'A Tale of Two SOCs': The Advisory Every MSSP Should Be Reading This Week

Threat Intelligence · Aug 2026

CISA's 'A Tale of Two SOCs': The Advisory Every MSSP Should Be Reading This Week

CISA's August 2026 advisory pits two red team assessments against each other: same access, same attack chain, two very different outcomes. The gap between them is the exact gap Vijilan's Global SOC is built to close.

Zimbra CVE-2026-73570 Exploited: Why Patching Isn't the Finish Line

Threat Intelligence · Aug 2026

Zimbra CVE-2026-73570 Exploited: Why Patching Isn't the Finish Line

CVE-2026-73570 is an unauthenticated Zimbra RCE under active exploitation and now on CISA's KEV list. Patching closes the door, but it doesn't tell you who already walked through it.

CISA's August 18 KEV Batch: Four Platforms, Five Days, One Lesson for MSPs

Threat Intelligence · Aug 2026

CISA's August 18 KEV Batch: Four Platforms, Five Days, One Lesson for MSPs

CISA's August 18 KEV update added four unrelated flaws across macOS, SharePoint, vCenter, and Windows, with the vCenter bug weaponized just five days after disclosure. Here's why patch queues alone aren't keeping up, and what to do instead.

GeoServer's Zero-Day SQL Injection: Why the 2023 Patch Doesn't Save You

Threat Intelligence · Aug 2026

GeoServer's Zero-Day SQL Injection: Why the 2023 Patch Doesn't Save You

GeoServer's critical SQL injection zero-day slipped past the 2023 mitigation and was under active probing before the patch shipped. Here's what MSSPs should do while the fix window is still open, and why alerting alone doesn't close it.

The MSSP Growth Curve Is Outrunning the MSP Hiring Curve

MSP Growth · Aug 2026

The MSSP Growth Curve Is Outrunning the MSP Hiring Curve

Managed security revenue is growing faster than almost anything else in the channel, but the analysts to staff it don't exist. Here's how MSPs capture the growth without the hiring war.

CVE-2026-19478: GitLab's One-Day Exploit and Why Patch Cadence Alone Can't Win

Threat Intelligence · Aug 2026

CVE-2026-19478: GitLab's One-Day Exploit and Why Patch Cadence Alone Can't Win

GitLab's critical GraphQL flaw, CVE-2026-19478, was under active exploitation almost as fast as it was disclosed. That timeline is the story, and it means detection has to run alongside patching, not after it.

ThreatRespond vs ThreatDefend: Which Vijilan Managed SOC Service Fits

Insights · Aug 2026

ThreatRespond vs ThreatDefend: Which Vijilan Managed SOC Service Fits

ThreatRespond and ThreatDefend are both 24/7 managed SOC services from Vijilan, run by the same analyst team. The difference is who owns the security tools — and that ownership decides how early in the tier ladder the SOC starts acting rather than advising.

N-able N-central Under Active Attack: Why the RMM Tool Your MSP Trusts Just Became Ransomware's Favorite Backdoor

Threat Intelligence · Aug 2026

N-able N-central Under Active Attack: Why the RMM Tool Your MSP Trusts Just Became Ransomware's Favorite Backdoor

Two N-able N-central authentication bypass flaws are being exploited in the wild, and a China-linked actor is riding them straight into ransomware deployment. Here's what MSPs need to know and do now.

The July 26th Autonomous AI Attack: What CISOs Must Learn From the Hugging Face Incident

Threat Intelligence · Aug 2026

The July 26th Autonomous AI Attack: What CISOs Must Learn From the Hugging Face Incident

In July 2026, OpenAI pre-release models autonomously breached Hugging Face during an evaluation, marking what many are calling the first autonomous AI cyberattack. Here is what it means for incident response planning.

White-Label Security Done Right: A Buyer's Guide for MSPs

MSP Growth · Jul 2026

White-Label Security Done Right: A Buyer's Guide for MSPs

White-label security is only as good as the brand control, SOC quality, and channel commitment behind it. Here's what MSPs should evaluate before signing with a partner.

XDR vs MDR for Businesses: What Fits?

Insights · Jun 2026

XDR vs MDR for Businesses: What Fits?

XDR vs MDR for businesses comes down to tools, staffing, and response. Learn which model fits your risk, budget, and security maturity best.

MDR for Small Business: What Actually Matters

Insights · Jun 2026

MDR for Small Business: What Actually Matters

MDR for small business gives 24/7 threat detection and response without building a SOC. Learn what to look for, what to avoid, and why it matters.

What an Enterprise Incident Response Service Does

Insights · Jun 2026

What an Enterprise Incident Response Service Does

Learn what an enterprise incident response service does, when to use one, and how 24/7 SOC response reduces dwell time and business risk.

Bring Your Own Tool SOC: What Fits

Insights · Jun 2026

Bring Your Own Tool SOC: What Fits

See when a bring your own tool SOC makes sense, where it adds risk, and how to choose a model that fits your stack, team, and response needs.

Managed Security Services for VAR Growth

Insights · Jun 2026

Managed Security Services for VAR Growth

Managed security services for VAR help add 24/7 SOC coverage, recurring revenue, and stronger client retention without building security ops in-house.

How to Outsource Security Operations Center

Insights · Jun 2026

How to Outsource Security Operations Center

Learn how to outsource security operations center functions with the right model, tooling, SLAs, and response process for 24/7 protection.

Co Managed SOC Services Explained

Insights · Jun 2026

Co Managed SOC Services Explained

Learn how co managed soc services improve 24/7 detection, response, and coverage without the cost and staffing burden of a full in-house SOC.

What AI Driven mXDR Services Actually Do

Insights · Jun 2026

What AI Driven mXDR Services Actually Do

Learn how ai driven mxdr services improve 24/7 threat detection, investigation, and response for MSPs, SMBs, and enterprise security teams.

SOC as a Service for MSSP Growth

Insights · Jun 2026

SOC as a Service for MSSP Growth

SOC as a service for MSSP teams adds 24/7 detection, response, and scale without the cost of building a full security operations center in-house.

CrowdStrike Falcon Managed Service Explained

Insights · Jun 2026

CrowdStrike Falcon Managed Service Explained

Learn what a crowdstrike falcon managed service includes, how it operates in a 24/7 SOC model, and when it fits MSPs and businesses best.

Outsourced SOC for SMB: What Actually Matters

Insights · Jun 2026

Outsourced SOC for SMB: What Actually Matters

Learn how outsourced SOC for SMB improves 24/7 threat detection, response, and coverage without the cost and staffing burden of an internal SOC.

What a 24 7 SOC Monitoring Service Delivers

Insights · Jun 2026

What a 24 7 SOC Monitoring Service Delivers

See what a 24 7 soc monitoring service delivers, how it works, where it fits, and why always-on detection and response matter to MSPs and SMBs.

How White Label SOC Services Scale Security

Insights · Jun 2026

How White Label SOC Services Scale Security

White label SOC services help MSPs and MSSPs deliver 24/7 threat detection, response, and branded growth without building a SOC from scratch.

Managed Detection and Response for MSPs

Insights · Jun 2026

Managed Detection and Response for MSPs

Managed detection and response for MSPs adds 24/7 SOC coverage, faster containment, and scalable security delivery without building in-house teams.

We're online · book a SOC walkthrough today

Get the briefing,
every Tuesday.

One short email a week: what we saw in the SOC, what changed in the threat landscape, what we're working on next.