php2shell (CVE-2026-109618/CVE-2026-109619) is a memory-corruption RCE in PHP. Blocking what a compromised worker can do next matters more than racing to patch.

It was a Saturday when a friend called. His company had been hit, a ransom demanded, could I help. I walked into an incident that looked already over: every VM…

New Goat scenarios turn 2025-2026's real Kubernetes and container-runtime research — rootkits, eBPF backdoors, runc escapes, and more — into automated attack chains you can run against your SOC.

Customer-hosted plugins let you extend AI security agents with custom tools running in your own cloud. Securely connect agents to your code, infrastructure, and internal systems to validate vulnerabilities, investigate threats, and automate organization-specific security workflows, without exposing secrets outside your environment.

In a live run of the Part 2 attack, Stream.Security's AI SOC detected the compromised key, reconstructed the full attack chain including a hidden persistence backdoor, and deleted the stolen credential on its own, stopping the attack in about ten minutes with no human in the loop. Part 4 of the Building the Agentic SOC series is about the decision that made that safe: which response actions a human lets an AI agent take autonomously, and why that call belongs to the Security Architect.

One attack in Part 2 threw off four separate alerts, and the obvious fix, one investigation agent per alert, rebuilds every failure of the overloaded human SOC at machine speed and cost. Part 3 of the Building the Agentic SOC series lays out the alternative: every related alert attaches to one linked case, worked by a small set of specialized agents, a dispatcher and case leader, over one shared model of the case and the environment.

An AI agent given a single leaked AWS key escalated from a low-privileged Lambda user to full account takeover in under 25 minutes, wrong turns included. Part 2 of the Building the Agentic SOC series walks through the attack step by step, from credential theft to a brute-forced admin identity, to show exactly what the agentic SOC has to detect and stop.

Security Architects are measured on how well they design defense, almost never on how well the SOC can respond to what that design misses. As AI turns the SOC from an organization into a system of agents, closing that gap becomes an architecture problem, and the Security Architect is the only one positioned to own it. Part 1 of a series building an agentic SOC hands-on with the open-source CDRGoat project.

Stream.Security is expanding workload protection with Response Actions, enabling security teams to contain threats directly from the Investigator UI in real time using the same lightweight eBPF agents already deployed for detection.

AI agents and tools won't scale security until the environment itself is modeled. Real context isn't enrichment — it's a live representation of state. That shift changes what tools, harnesses, and agents actually mean, and what StreamForce is built on.

AI workloads are dynamic, abstracted, and deeply embedded into modern applications, making them hard to track with traditional security tools. This creates a growing “shadow AI” problem where models, agents, and tools operate without oversight. Our AI workload discovery solves this by continuously analyzing cloud-native logs and runtime signals to identify all AI components in your environment—including hosted services, models, tools, and MCP servers. Each component is correlated to the workload executing it, the identity behind it, and its behavior over time. By baselining this activity, security teams can quickly spot anomalies such as new models, unauthorized integrations, or unusual usage patterns. More importantly, this visibility feeds directly into detection and response, enabling full attack storylines that include the AI layer.

Stream Security now supports native ingestion of OpenAI Platform audit logs, extending real-time threat detection and response to your AI control plane. Security teams gain immediate visibility into sensitive administrative activity across OpenAI Platform Organizations including API key lifecycle events, service account creation, identity and role changes, project configuration updates, and security control modifications like IP allowlists and SCIM. The integration is agentless, easy to enable, and provides out-of-the-box detections so teams can investigate and respond faster from a unified cloud security platform.