The Red Canary Blog: Information Security Insights

Worms break ground and fake browser updates march forward in this month's edition of Intelligence Insights

Cloud security is a rapidly accelerating challenge for security operations—a trend highlighted in our 2025 Threat Detection Report.

Our annual analysis brings you a year’s worth of security operations and intelligence insights, with actionable guidance on every page.

We wrote the playbook on detection-as-code detection engineering. Forrester now recognizes us among top vendors in the MDR market.

Red Canary now offers cost-efficient data storage that improves your security posture. Learn more about our new Security Data Lake offering.

RSpec metadata helps Red Canary’s engineers generate clean and consistent tests in our Ruby on Rails application

Infrared Ibis infiltrates Chrome extensions and Saffron Starling surprises in this month's edition of Intelligence Insights

Follow the yellow brick tunnel for malware analysis of RATs and worms and spyware, oh my! Read our deep dive on network tunneling.

Why automated response is a necessity to thwart ransomware attacks in Amazon Web Service cloud environments

In the world of identity, cloud, and SaaS, we must move beyond detecting explicitly malicious behaviors to detecting unusual behaviors.

DarkGate returns and the Tangerine Turkey VBS worm peels off of USBs in this month's edition of Intelligence Insights

Named by Red Canary, Tangerine Turkey is a VBscript worm delivered via USB that ultimately drops a cryptomining payload

An engineer behind Red Canary’s GCP integration recounts how we remodeled our detection engine to ingest millions of new telemetry logs

With the right guardrails, AI agents quantifiably improve speed in your security operations center, without compromising accuracy

Red Canary parses through 6 billion telemetry records per day to detect threats in our customers’ cloud environments. Here’s how we do it.

A step-by-step guide to building a framework for ingesting billions of cloud telemetry records to detect and respond to cyber threats

Paste and run persists and HijackLoader cuts the line to drop LummaC2 in this month's edition of Intelligence Insights

As Red Canary wraps up our first decade, take a look back at our best blogs, videos, guides, and webinars of the year.

Everything defenders need to know about identity attack technqiues and how to protect your users and assets

SSO access tokens can buy adversaries more time as they exfiltrate credentials and other sensitive information from a victim’s AWS CLI