Insights from the front line.

It said .TXT. It ended in .exe. It called Luxembourg about a second after it ran.

Hunting PHP2Shell using custom queries in Command Zero, chained into an investigation that ends in a verdict, and a platform-agnostic web server hunt for whatever exploit comes next.

Two AI agents on one laptop. One was an accomplice. I was the other one.

PHP2Shell drew attack traffic before its patch shipped, and Storm-0940 reached privileged cloud access in under three hours. What that means for how fast investigations have to run.

Attackers used ConnectWise's own app credentials to sign in to Microsoft 365 tenants. Here's how to hunt for the sign-ins, the self-assigned roles, and the client secrets they left behind.

A departing engineer used an AI coding agent to harvest credentials, delete files and wipe logs in 64 minutes. Here is how an autonomous investigation reconstructed it.

Four devices. Two Trojan families. Zero executions. It took fifteen questions to earn that last number.

Today’s most dangerous threats hide inside trusted software updates, vendor tools, and internal memos.

Today, Command Zero is coming out of stealth, ready to revolutionize security operations.

Real-World Impact: Get to Answers in Minutes, not Hours

Streamlining locked account investigations with Command Zero

Command Zero set out to solve the most significant bottleneck for security operations: investigations. There are a lot of solutions (like SIEM, SOAR, SOC automation, AI-powered SOC analysts) available