Case Study: A County’s Journey from Chasing Alerts to Stopping Threats
Explore how a Texas county transformed its cybersecurity from reactive to proactive, partnering with Recon to enhance security and protect against threats.
Recon Team
Cybersecurity Articles
Research, guides, and news from the Recon InfoSec team.
Cross-Org Visibility for LimaCharlie
Discover how Recon InfoSec enhances security operations with LimaCharlie, offering cross-org visibility through a Prometheus exporter for unified insights.
Ben Webb
What's Actually Hitting Organizations Right Now: ClickFix, Identity Compromise, and AI-Powered Risk
Explore current security threats like ClickFix, identity compromise, and AI risks, and learn how to protect your organization from evolving attacks.
Andrew Cook
Iranian Government Affiliated Intrusions: Documented Tradecraft
Insights into Iranian cyber tactics, targeting critical sectors, and defensive measures based on documented tradecraft from CISA, FBI, and NSA reports.
Luke Rusten
ClawHype: Making Sense of Recent AI Cybersecurity News
Is your team using unauthorized AI? Learn how to navigate the security risks of OpenClaw and Moltbook. Get expert AI governance advice and actionable security rules for IT managers to protect your organization's data.
Nicholas Lupien
Planning for the Worst: Making IR, BC, and DR Plans Work
Learn how to create effective Incident Response, Business Continuity, and Disaster Recovery plans to protect your organization from ransomware and other cyber incidents.
Macie Thompson
Case Study: From Running Blind to Active Defense
Discover how a mid-size energy infrastructure company transformed its security posture, achieving a 95%+ security score and peace of mind through strategic partnerships and active defense.
Recon Team
A Pragmatic Approach to Vulnerability Management
Is your vulnerability data just noise? Is traditional CVSS scoring failing to measure real-world risk? Discover a pragmatic approach for filtering, prioritizing, and gaining value.
Ben Webb
Every Pentest Makes us Better
Recon InfoSec treats every pentest as a real attack, using them to enhance detection logic, refine procedures, and strengthen overall SOC operations.
Andrew Cook
Delivering AI Superpowers to Security Teams: Introducing Recon Labs
Introducing Recon Labs: Empowering security teams with AI to enhance investigations, automate workflows, and reduce false positives, transforming how professionals combat evolving threats.
Nicholas Lupien
Microsoft Teams Social Engineering: A Ransomware Attack Vector
Microsoft Teams is being abused in ransomware campaigns to gain VPN access. Learn the tactics and how to safeguard your organization.
Andrew Cook
Mastering Threat Hunting Operations: A Deep Dive into Recon InfoSec’s Approach
Explore Recon InfoSec's proactive threat hunting methodology. Learn how our team uses threat intelligence, hypothesis-driven investigations, & tools to find and mitigate hidden threats before they cause damage.
Watson Brown
Prolific Phishing Campaign Leveraging Zoom's Infrastructure
Phishing campaign exploits Zoom Events infrastructure to deliver credential phishing and malicious downloads, bypassing email security filters. Learn how to protect your organization.
Michael Robertson
Detecting Fake CAPTCHA Campaigns: ClickFix, ClearFake, and Etherhide
Discover how cybercriminals trick users with fake CAPTCHA pages to deploy malware and learn effective detection techniques to safeguard your systems against these evolving threats.
Luke Rusten
SigmaHQ Essentials - Building Robust Detection Capabilities - Part 2
The blog post provides a detailed guide on creating SigmaHQ detections. It explains the process of selecting relevant log data and translating it into a Sigma detection rule, emphasizing the importance of customized detections for better security monitoring.
Watson Brown
Effective Threat Hunting
Learn effective threat hunting strategies from Luke Rusten's insights on prioritization, continuous improvement, and practical techniques to enhance your organization's security operations.
Luke Rusten
SigmaHQ Essentials - Building Robust Detection Capabilities
This series of blog posts should cover the basics to get you started. What is sigmaHQ? How are detections written? How can detection engineering be integrated into your tools/soc/security team? And a few other fancy uses you can get out of this free and amazing repository of detections.
Watson Brown
Your Ransomware Incident Is Predictable. . .
Explore the predictable patterns of ransomware attacks and learn how to fortify your defenses with this insightful blog. Discover the common entry points, defense strategies, and recovery plans to keep your organization one step ahead of cybercriminals.
Andrew Cook
Advanced Email Protection: Detection Techniques in Action
Take a deeper dive into Advanced Email Protection from Recon InfoSec.
Macie Thompson
Advanced Email Protection to be Thrilled About
Recon Infosec's Advanced Email Protection (AEP) service represents a significant leap forward in fortifying organizations against the pervasive threat of email-based attacks. With AEP, organizations can ensure that their digital assets remain secure.
Macie Thompson
Plan for When...
Increase your cybersecurity readiness with a solid plan for when breaches happen. Learn how to identify your response team, create a communication plan, document your strategy, and exercise it regularly.
Macie Thompson
Digital Age: The Power of Canary Tokens and Deception Technology in Cybersecurity
In the pantheon of security systems few things are as under-rated as deception systems. Learn why they work and what more is needed.
Ben Webb
The Lockbit Ransomware Group Disruption: Now What?
Lockbit may be gone, but the market for Ransomware as a Service (RaaS) is still here. Lasting change will require us to make these attacks less profitable.
Ben Webb
Business Email Compromise & Wire Transfer Fraud
User training and guidance you can send right now to help prevent your organization from becoming a victim of wire transfer fraud.
Andrew Cook