Video•Feb 17, 2026
Blue Team | Intelligence-Driven Defense for the Real World
The video outlines an intelligence‑driven approach to blue‑team operations, arguing that modern cyber‑threat intelligence (CTI) must evolve from static reports into an operational pipeline that turns external threat feeds and internal telemetry into concrete defensive actions. The speaker, who credits CTI with saving his career during a NASDAQ IPO, frames the discussion around building a “pipeline” that starts with clear business objectives, collects relevant data, enriches it with AI, and feeds it into detection rules, hunting queries, and response playbooks. Key insights include the need to cut through noisy alerts by prioritizing true threats, integrating external sources such as dark‑web leaks and supply‑chain signals with internal logs, and using AI to add context quickly. The speaker stresses that CTI is not just a subscription service; it requires a feedback loop where analysts, incident responders, and risk managers validate and refine intelligence, ensuring it stays aligned with evolving adversary tactics and the organization’s risk profile. Illustrative examples range from a small MSSP that built open‑source pipelines to serve dozens of clients, to the speaker’s own experience of leveraging CTI during a high‑stakes IPO. He also highlights how correlating a leaked credential on the dark web with internal DNS queries can surface a breach before it materializes, and how supply‑chain indicators often precede internal compromise. The implication for enterprises is clear: without an operational CTI framework, blue teams remain reactive, overwhelmed by alerts, and vulnerable to asymmetric attacks. Investing in AI‑enhanced enrichment, open‑source tooling, and continuous feedback transforms raw threat data into actionable defense, improves risk management, and aligns security outcomes with business goals.
By SANS Institute
Video•Feb 17, 2026
Red Team | Weaponizing LLM Fine-Tuning for Stealthy C2
Researchers from Palo Alto Networks' Cortex team demonstrated how attackers can weaponize fine-tuning of large language models to build stealthy command-and-control channels that live inside popular AI models. They show attackers already using LLMs for reconnaissance, social engineering and coding,...
By SANS Institute
Video•Feb 17, 2026
Blue Team | From Exploit to Risk: Scaling Purple Team Insights
Anthony Switzer argues for “first-principle purple teaming,” a methodology that converts red-team and pentest findings into actionable business risk and mission impact. He stresses translating technical detections (e.g., Active Directory exploits, MITRE mappings) into language executives and auditors understand, and...
By SANS Institute
Video•Feb 17, 2026
Blue Team | Hunting Cloud Persistence Without Malware
The talk explains how modern attackers achieve long-term cloud persistence without malware by abusing legitimate cloud-native features—OAuth app consent, stolen or replayed tokens, mismanaged service principal credentials, long-lived API keys, mailbox rules and automated connectors. These malicious activities blend into...
By SANS Institute