The Red Canary Blog: Information Security Insights

Adversaries can exploit CVE-2025-31324 to upload web shells and other unauthorized files to execute on the SAP NetWeaver server

Amber Albatross looms large and Arechclient2 makes its debut in this month's edition of Intelligence Insights

Which cybersecurity metrics should SOC teams be tracking to measure their success in detecting and responding to threats?

From conversations on hacking to cybercrime capers, we look at 10 cybersecurity podcasts to learn more about the field.

Humans are creatures of habit and unusual logins are a great signal for detection, if you can gather and make sense of identity telemetry.

How AI agents can help purple teaming, inside the stolen credential ecosystem, and more: We read through the RSA agenda so you don't have to.

Inspired by our newly released Threat Detection Report, here are five things defenders can do right now to strengthen their security posture.

Worms break ground and fake browser updates march forward in this month's edition of Intelligence Insights

Cloud security is a rapidly accelerating challenge for security operations—a trend highlighted in our 2025 Threat Detection Report.

Our annual analysis brings you a year’s worth of security operations and intelligence insights, with actionable guidance on every page.

We wrote the playbook on detection-as-code detection engineering. Forrester now recognizes us among top vendors in the MDR market.

Red Canary now offers cost-efficient data storage that improves your security posture. Learn more about our new Security Data Lake offering.

RSpec metadata helps Red Canary’s engineers generate clean and consistent tests in our Ruby on Rails application

Infrared Ibis infiltrates Chrome extensions and Saffron Starling surprises in this month's edition of Intelligence Insights

Follow the yellow brick tunnel for malware analysis of RATs and worms and spyware, oh my! Read our deep dive on network tunneling.

Why automated response is a necessity to thwart ransomware attacks in Amazon Web Service cloud environments

In the world of identity, cloud, and SaaS, we must move beyond detecting explicitly malicious behaviors to detecting unusual behaviors.

DarkGate returns and the Tangerine Turkey VBS worm peels off of USBs in this month's edition of Intelligence Insights

Named by Red Canary, Tangerine Turkey is a VBscript worm delivered via USB that ultimately drops a cryptomining payload

An engineer behind Red Canary’s GCP integration recounts how we remodeled our detection engine to ingest millions of new telemetry logs