Insights from the front line.

It said .TXT. It ended in .exe. It called Luxembourg about a second after it ran.

An email from the user, to the user, asking for a payment signature. Nineteen messages, one body fingerprint, and a Google Maps redirect hiding the destination. Here is how I took the campaign apart.

Hunting PHP2Shell using custom queries in Command Zero, chained into an investigation that ends in a verdict, and a platform-agnostic web server hunt for whatever exploit comes next.

Two AI agents on one laptop. One was an accomplice. I was the other one.

PHP2Shell drew attack traffic before its patch shipped, and Storm-0940 reached privileged cloud access in under three hours. What that means for how fast investigations have to run.

Command Zero is a launch partner in Tenable OPEN for AI. Dov Yoran on turning exposure findings into auditable investigations, and why we built Command Zero.

Attackers used ConnectWise's own app credentials to sign in to Microsoft 365 tenants. Here's how to hunt for the sign-ins, the self-assigned roles, and the client secrets they left behind.

A departing engineer used an AI coding agent to harvest credentials, delete files and wipe logs in 64 minutes. Here is how an autonomous investigation reconstructed it.

Four devices. Two Trojan families. Zero executions. It took fifteen questions to earn that last number.

Five countries. Five blocked sign-ins. Two account unlocks that nobody blocked.

Sixteen Okta logins from seven countries, most behind VPNs. Impossible travel said compromise, but it was the weakest witness. Here are the four signals that actually closed the case.

Taking action on what AI cyber agents find is a different problem than actions from what a human agent finds, and security leaders are learning to draw the line between the two.

Teams routinely wait for an endpoint security tool to trigger an alert before initiating an investigation. This defensive posture creates a dangerous window of opportunity.

When an attacker moves across identity, endpoint, and productivity apps in the same attack, a single-source AI catches one piece and closes the ticket on what it can see.

The average SOC runs investigation after triage creating a gap where incidents expand. Fixing that gap requires making investigation intelligence portable.

An autonomous analyst opens his case files. Every question, every dead end, every moment a clean theory fell apart. No vendor gloss, no marketing victory laps. Just the work.

A common theme across the majority of conversations I've been having recently is that of what happens to the security practitioners role and whether or not some jobs will survive AI.

By the Time a Case Reaches Tier 3, It’s Already a Mess

Today, Command Zero is coming out of stealth, ready to revolutionize security operations.

The hard truth: Emails are full user identities

What we predict for 2025 based on these FAQs

Command Zero set out to solve the most significant bottleneck for security operations: investigations. There are a lot of solutions (like SIEM, SOAR, SOC automation, AI-powered SOC analysts) available