Threat actors predominately exploited public-facing applications for the second quarter in a row, with this tactic appearing in nearly 40 percent of Cisco Talos Incident Response (Talos IR) engagements — a notable decrease from over 60 percent last quarter, when engagements involving ToolShell surged. This quarter included exploitation of Oracle E-Business Suite (EBS) and React2Shell, as well as the deployment of malware implants previously associated with advanced persistent threat (APT) groups.  

Phishing was the second-most common tactic for initial access, and this quarter included a campaign specifically targeting Native American tribal organizations for credential harvesting. Once the adversaries compromised a legitimate account, they leverage it to send out further internal phishes and gain more credentials.  

Ransomware incidents made up only approximately 13 percent of engagements this quarter, a decrease from 20 percent last quarter and a steep drop from nearly 50 percent in Q1 and Q2. Talos IR did not respond to any previously unseen ransomware variants. Qilin continues to be a dominant player in these engagements, a continuation from the previous few quarters.   

Continued exploitation campaigns show the importance of timely patching  

As mentioned above, threat actors exploited public-facing applications for initial access in nearly 40 percent of engagements this quarter. While there was no dominant exploitation campaign as there was last quarter with ToolShell, Talos IR did observe activity targeting Oracle EBS (CVE-2025-61882) as well as React Server Components, Next.js, and related frameworks (CVE-2025-55182 aka React2Shell). In both cases, exploitation activity occurred around the time the vulnerability became public, demonstrating actors’ speed in capitalizing on these opportunities as well as the inherent risks of internet-facing enterprise applications and default deployments embedded in widely used frameworks.    

Talos IR responded to an organization that had an internet-facing server vulnerable to CVE-2025-61882. Exploitation began very shortly after the vulnerability was made public and was likely related to a large-scale campaign aiming to extort executives. After exploiting the vulnerability, the threat actors deployed multi-stage web shells related to the SAGE* infection chain.   

In another incident, we observed a threat actor successfully exploit the React2Shell vulnerability to compromise the victim organization, gain shell access to the web server, and download and install XMRig Monero cryptomining malware. Cryptocurrency mining is one of the many types of operations we expect to see as threat actors race to quickly capitalize on unpatched systems. Public reporting on React2Shell exploitation also revealed targeting by state-sponsored groups, ransomware affiliates, and more, highlighting the diverse array of threat actors who look to leverage new exploits and the importance of timely patching and other mitigations, such as robust segmentation.   

Exploitation activity this quarter also involved implants previously tied to APT groups. In one incident, Talos IR observed activity consistent with the BadCandy implant targeting Cisco IOS XE. The threat actors leveraged this implant to create an unauthorized account, though the activity appeared to be automated with no interactive access or additional malicious activity observed outside the router.   

In an incident in which exploitation of the organization’s Cisco Secure Management Appliance (SMA) was suspected, the adversaries deployed AquaShell, a lightweight Python backdoor capable of receiving encoded commands through unauthenticated HTTP POST requests and executing them in the system shell, a backdoor which Talos has connected to UAT-9686. Similar to the incident described above, there was no follow-on activity observed. In both incidents, Talos IR commended the customers for their quick responses, which likely helped mitigate any further damage.

Phishing campaigns target Native American tribal organizations for potential credential harvesting operation   

Phishing was the second-most common means of initial access this quarter, and Talos IR responded to a phishing campaign that appeared to target Native American tribal organizations.   

In one incident affecting a tribal organization, Talos IR observed adversaries use compromised email accounts, alongside a legitimate but compromised web domain, to distribute lures themed around sexual harassment training. Although initial waves were unsuccessful, once the adversaries compromised an account, they used it to propagate further phishing internally and externally. In the latter phases of this campaign, the adversary leveraged a web shell directory hosted on a legitimate third-party domain to distribute phishing content and facilitate broader targeting. We suspect that the attacker gained a foothold within the victim environment due to lack of multi-factor authentication (MFA), and while no lateral movement beyond email account abuse could be confirmed, the exposure of additional accounts within the victim’s environment and external recipients indicates the potential for a wider impact.   

In a second related incident affecting another tribal organization, Talos IR observed the victim receive a wave of external phishing emails, with one user targeted with numerous Outlook Web Access (OWA) login attempts, resulting in subsequent MFA prompts, one of which was approved. Afterwards, the compromised user’s account was used to issue a flood of follow-on phishing emails. After the customer removed the compromised account, the campaign continued, leveraging an external email address that was spoofed to resemble the disabled account.   

Beyond similar victimology, there were overlaps in the indicators of compromise for these incidents, suggesting they may have originated from the same campaign. Both incidents also highlight a trend observed last quarter of compromised accounts being used to distribute further phishing attacks. Talos IR urges tribal organizations to be especially vigilant of this threat, scrutinizing all emails and MFA pushes.

Ransomware trends 

Ransomware and pre-ransomware incidents made up just 13 percent of engagements this quarter, a decline from 20 percent last quarter, and a sharp drop from 50 percent in Q1 and Q2. Qilin ransomware, which we responded to for the first time in Q2, remains dominant and was observed in the majority of ransomware incidents, confirming our predictions in Q2 and Q3 that the group would continue to hold a heavy presence. We also responded to DragonForce ransomware, a variant we had not observed in Talos IR engagements for over a year.

Talos IR responded to a ransomware incident in which the adversary deployed multiple remote monitoring and management (RMM) tools across the attack chain. After leveraging valid accounts for initial access, they relied on ScreenConnect for persistence, SoftPerfect Network Scanner for reconnaissance, and rclone to exfiltrate data. This is a trend we have observed in other threat activity as well, such as a social engineering campaign this quarter in which the threat actors used multiple RMM tools for initial access and persistence. Relying on multiple tools can better facilitate the attack in case one is detected or blocked by security controls. In addition, because these tools may be legitimately used in an environment, they may be harder for defenders to detect in the first place.

Targeting

Consistent with last quarter, public administration was the most-targeted industry vertical. This is noteworthy as last quarter was the first time since we began publishing these reports that public administration held this position. Organizations within the public administration sector are attractive targets as they are often underfunded and use legacy equipment. These entities may have access to sensitive data as well as a low downtime tolerance, making them attractive to financially motivated and espionage-focused threat groups. We observed exploitation and phishing campaigns targeting these organizations, with one successful phishing campaign leveraging a compromised account to send out follow-on internal and external phishes, making them appear more legitimate.

Initial access

Also consistent with last quarter, the most observed means of gaining initial access was exploitation of public-facing applications, accounting for over a third of the engagements where initial access could be determined. As mentioned, this is a sharp drop from 62 percent last quarter in which widespread ToolShell exploitation occurred. Other observed means of initial access included phishing, which increased from 23 percent last quarter to 32 percent, as well as valid accounts and brute forcing.

Recommendations for addressing top security weaknesses

Conduct robust patch management  

35 percent of engagements this quarter involved vulnerable or exposed infrastructure, aligning with the percentage of engagements in which Talos IR observed exploitation of publicly facing applications. This included exploitation of the React2Shell vulnerability, Oracle EBS, as well as exposed Cisco products such as Cisco IOS XE WebUI. These latter incidents underscore the importance of limiting the exposure of vulnerable and high-value servers. Though some of these vulnerabilities were older, once again highlighting the fact that adversaries can find success with years-old exploits, others were targeted right around disclosure, showing the importance of timely patching. Relatedly, there were several incidents in which exposed GitHub secrets were leveraged to access and exfiltrate sensitive data.

Implement detections to identify MFA abuse and strong MFA policies  

MFA issues, including misconfigured MFA, lack of MFA, and MFA bypass, were another top security weakness this quarter, aligning with phishing being the second-most prominent initial access technique. This included issues such as a lack of MFA as well as MFA fatigue. Talos IR recommends configuring systems to monitor and alert on the following for effective MFA deployment: abuse of bypass codes, registration of new devices, creation of accounts designed to bypass or be exempt from MFA, and removal of accounts from MFA.

Configure centralized logging capabilities across the environment  

Insufficient logging capabilities once again hindered investigative efforts by Talos IR. Understanding the full context and chain of events performed by an adversary on a targeted host is vital not only for remediation but also for enhancing defenses and addressing any system vulnerabilities for the future. Talos IR recommends that organizations implement a Security Information and Event Management (SIEM) solution for centralized logging. In the event an adversary deletes or modifies logs on the host, the SIEM will contain the original logs to support forensic investigation.

Timely response is paramount  

Finally, several incidents this quarter revealed the value of quick responses, such as several exploitation attacks against Cisco products in which timely cooperation with Talos IR helped prevent follow-on attacks. This quarter, we also responded to a ransomware incident in which an organization delayed engaging with Talos IR, and thus were unable to prevent encryption or exfiltration of sensitive data. For more information on how timely response can dramatically improve outcomes, please see the this blog.

Top-observed MITRE ATT&CK techniques  

The table below represents the MITRE ATT&CK techniques observed in this quarter’s Talos IR engagements. Given that some techniques can fall under multiple tactics, we grouped them under the most relevant tactic in which they were leveraged. Please note this is not an exhaustive list.  

Key findings from the MITRE ATT&CK framework include:  

• Adversaries leveraged a wider variety of techniques for credential access this quarter compared to last quarter, including discovery of remote systems, domain trust relationships, and valid accounts.   
• This was the second quarter in a row where exploitation of public-facing applications was the top initial access technique.   
• Use of Remote Desktop Protocol (RDP) was the top technique for lateral movement for the second quarter in a row.

Tactic	Technique	Example
Reconnaissance	T1597 Search Open Websites/Domains	Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.
	T1018 Remote System Discovery	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network.
	T1482 Domain Trust Discovery	Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
	T1087 Account Discovery	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
Initial Access	T1190 Exploit Public-Facing Application	Adversaries may exploit a vulnerability to gain access to a target system.
	T1598 Phishing for Information	Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.
	T0859: Valid Accounts	Adversaries may steal and abuse the credentials of a specific user or service account using credential access techniques.
	T1110 Brute Force	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
Execution	T1059 Command and Scripting Interpreter	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
	T1204.001 User Execution: Malicious Link	An adversary may rely upon a user clicking a malicious link in order togain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution.
	T1204.002 User Execution: Malicious File	An adversary may rely upon a user opening a malicious file in order to gain execution.
	T1078 Valid Accounts	Adversaries may obtain and abuse credentials of existing accounts to access systems within the network and execute their payload.
	T1047 Windows Management Instrumentation	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
	T1505.003 Server-side Web Shell	Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Persistence	T1136 Create Account	Adversaries may create an account to maintain access to victim systems.
	T1219 Remote Access Tools	An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
	T1059 Command and Scripting Interpreter	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
	T1053 Scheduled Task/Job	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
	T1078 Valid Accounts	The adversary may compromise a valid account to move through the network to additional systems.
Defense Evasion	T1562 Impair Defenses	Adversaries may maliciously modifycomponents of a victim environment in order to hinder or disable defensive mechanisms.
	T1070 Indicator Removal	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.
	T1218 System Binary Proxy Execution	Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
	T1564.008 Hide Artifacts: Email Hiding Rules	Adversaries may use email rules to hide inbound or outbound emails in a compromised user’s mailbox.
	T1112 Modify Registry	The Registry may be modified in order to hide configuration information or malicious payloads.
Credential Access	T1558.003 Steal or Forge Kerberos Tickets	Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable pass the ticket.
	T1003 OS Credential Dumping	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
	T1111 Multi-Factor Authentication Interception	Adversaries may target MFA mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources.
	T1552.001 Unsecured Credentials	Adversaries may search compromised systems to find and obtain insecurely stored credentials.
	T1110 Brute Force	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
Discovery	T1087 Account Discovery	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
	T1082 System Information Discovery	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
	T1083 File and Directory Discovery	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
	T1016 System Network Configuration Discovery	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
	T1046 Network Service Discovery	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
Lateral Movement	T1021.001 Remote Services: Remote Desktop Protocol	Adversaries may use Valid Accounts to log into a computer using RDP. The adversary may then perform actions as the logged-on user.
	T1021.002 Remote Services: SMB/Windows Admin Shares	Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
Command and Control	T1071 Application Layer Protocol	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.
	T1008 Fallback Channels	Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
	T1105 Ingress Tool Transfer	Adversaries may transfer tools or other files from an external system into a compromised environment.
	T1090 Proxy	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
Exfiltration	T1041 Exfiltration Over C2 Channel	Adversaries may steal data by exfiltrating it over an existing command and control channel.
	T1567 Exfiltration Over Web Service	Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.
Impact	T1486 Data Encrypted for Impact	Adversaries may use ransomware to encrypt data on a target system.
	T1485 Data Destruction	Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
	T1489 Service Stop	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
Software	S1242 Qilin	A Ransomware-as-a-Service (RaaS) that has been active since at least 2022 with versions written in Golang and Rust that are capable of targeting Windows or VMWare ESXi devices.
	S0591 ConnectWise	A legitimate remote administration tool that has been used since at least 2016 by threat actors.
	S1040 Rclone	A command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.
	S0029 PsExec	Free Microsoft tool that can remotely execute programs on a target system.

Cisco Talos Blog – ​Read More

Running a SOC today means constant trade-offs: too many alerts, not enough people, strict SLAs, and attacks that keep getting smarter. Most leaders aren’t asking for “the next cool product” but a proof that something actually cuts time, risk, and workload in real environments like theirs. 

Thousands of organizations already rely on ANY.RUN to reduce analyst load, resolve phishing cases faster, cut unnecessary escalations, and speed up detection so incidents are contained before they reach the business. 

Here we are bringing that evidence together. Let’s look at the results from different industries, how teams use ANY.RUN across Tier 1/2/3, and why it became a core part of their SOC operations, so if you’re still hesitating, you can see exactly what teams like yours are achieving with it. 

What Real Teams Achieve with ANY.RUN: Proven Results Across Industries 

When you look across banks, MSSPs, transport companies, and healthcare providers, the pattern is the same: once ANY.RUN becomes part of daily SOC operations, teams move faster, reduce noise, and prevent incidents earlier. 

Here are the outcomes customers report consistently: 

• 94% of users report faster phishing and malware triage in real SOC workflows. 

• 76% faster phishing triage for a healthcare MSSP (from 30–40 minutes down to 4–7 minutes). 

• 50%+ reduction in malware investigation and IOC extraction time. 

• Tier-1 closure rates rising from ~20% to around 70% after giving Tier 1 full behavioral evidence. 

• 30–55% fewer false escalations thanks to richer context and verdict confidence. 

• 21 minutes average MTTR reduction in SOCs that integrated ANY.RUN into their workflows. 

• 15 seconds MTTD for phishing and malware threats which allows analysts to accelerate their SIEM/SOAR investigations. 

• Insights from ANY.RUN’s solutions helped SOC and MSSP teams stop hundreds of ransomware attempts before they ever touched production systems. 

MSSP Success Case: Faster Threat Analysis Without Expanding the Team 

Expertware is a European MSSP with over 18 years of experience, providing SOC services to organizations across banking, insurance, retail, telecom, and other industries. Their cyber intelligence operations team supports multiple customers at once, where speed and depth of analysis directly impact SLAs. 

Challenge 

Before adopting ANY.RUN’s Interactive Sandbox, malware investigations required manually building and maintaining reverse-engineering environments. This slowed response times, limited visibility into full attack chains, and made it harder to scale analysis across multiple customers without adding workload. 

Outcome 

Expertware standardized a single analysis cycle centered on interactive execution and fast intelligence sharing: 

• Execute and observe: Suspicious files and phishing samples are detonated to expose full behavior and multi-stage chains. 

• Analyze in depth: Analysts interact with malware in real time to uncover obfuscation, memory-only stages, and C2 infrastructure. 

• Extract and share: Indicators and findings are mapped, documented, and shared across SOC and IR teams to speed decisions. 

This approach removed the need for custom VMs and reduced friction across investigations. 

Results 

• Over 50% reduction in malware investigation and IOC extraction time 

• Faster turnaround on customer incidents without increasing staff 

• Clear visibility into full kill chains, including fileless and memory-based stages 

• Easier collaboration through shared, interactive analysis reports 

• Improved SLA performance by resolving cases earlier in the workflow 

Healthcare MSSP Success Case: Faster Phishing Triage Without SLA Risk 

A mid-sized MSSP specializing in healthcare supports hospitals, clinics, and labs across thousands of endpoints. Operating in a highly regulated environment, the SOC had to balance strict SLAs, audit requirements, and a growing volume of phishing and malware alerts. 

Challenge 

As the customer base expanded, Tier 1 and Tier 2 teams were overwhelmed. Multi-stage phishing emails with redirects, QR codes, and CAPTCHA checks often took 30–40 minutes per case, driving escalations, slowing response, and putting SLA commitments at risk. 

Outcome 

The MSSP standardized a single operational triage cycle combining sandbox execution, threat intelligence, and detection feeds: 

• Early execution with the Interactive Sandbox cuts phishing triage by 76%, reducing analysis from 30–40 minutes to 4–7 minutes, while giving Tier 1 full visibility into real malware behavior. 

• Richer context through Threat Intelligence Lookup improves decision confidence, driving 34% fewer false escalations and enabling Tier 1 closure rates to rise from 20% to 70%. 

• Live intelligence via Threat Intelligence Feeds keeps detections current as attacker infrastructure rotates, resulting in faster MTTR and fewer false positives across automated workflows. 

• Continuous monitoring of active attacks affecting 15,000+ organizations enables early detection of the latest threats. 

Results 

Since we implemented new solutions, every investigation now comes with evidence and threat data, from MITRE tags to screenshots. This made reporting faster and extra work fell off our shoulders.

• 76% reduction in phishing triage time (from 30–40 minutes down to 4–7 minutes) 

• Higher Tier-1 closure rates with fewer escalations to Tier 2 

• Stronger SLA stability across multiple healthcare customers 

• Audit-ready investigations with clear execution evidence and context 

• A shift from reactive response to proactive, repeatable defense  

Banking Success Case: Faster Analysis, Stronger Security Outcomes 

A Brussels-based investment bank (750 employees) runs cybersecurity with a lean team of 12, where people often switch between threat analysis and incident response depending on what’s happening. 

Challenge 

When the Head of Cybersecurity joined, the security setup was “messier” than expected, and the team was getting swamped with alerts daily. Improving efficiency meant fixing the workflow, and a malware sandbox quickly became a top priority. 

Outcome 

The number of ransomware and credential stealing attempts we have prevented thanks to the sandbox is already in the hundreds.

After integrating ANY.RUN as part of a broader workflow overhaul, results showed up almost immediately. In the first week, the team was able to process alerts and threat analysis at least twice as fast, helping avoid incident response and recovery costs through timely actions. 

Results  

• 2× faster alert processing and threat analysis (visible in the first week) 

• Better understanding of malware behavior through VM control (browsing websites, downloading, executing files) 

• A faster, more practical approach than running custom-built VMs on isolated machines that take significant preparation 

• Prevented hundreds of ransomware and credential-stealing attempts over time 

• Stopped a supplier email attack by detonating the email, opening a password-protected ZIP, identifying a loader, and seeing it download and initiate ransomware in the VM, then blocking the email across the organization and warning other departments 

Transport Company Success Case: Real-Time Visibility into Active Cyber Attacks 

A multinational transport company operating across North America, Latin America, and Europe relies heavily on email to communicate with clients, contractors, and suppliers. With a 30-person security team, staying ahead of active attacks required a threat hunting approach that scaled without adding manual work. 

Challenge 

Attacker infrastructure changes rapidly, making static indicators and public reports outdated within days. Manually tracking phishing campaigns, malware activity, and CVEs relevant to the transport industry consumed time and made prioritization difficult. 

Outcome 

The team standardized a continuous threat hunting cycle that turns fresh execution data into detections: 

• Confirm reality with an interactive sandbox: Detonate suspicious samples to capture behavior and extract high-confidence artifacts. 

• Expand to campaign scope: Subscribe to TI Lookup’s Search Updates, pivot across related IOCs/IOAs/IOBs, domains, hosts, and historical activity. 

• Operationalize fast: Use TI Feeds to push validated indicators into existing security workflows so detections stay current. 

Results 

• Near real-time visibility → faster decisions while attacks are still active. 

• Quicker IOC/IOA/IOB discovery → shorter time to contain relevant threats. 

• Less manual research → more capacity without extra headcount. 

• Clear active vs. expired prioritization → steadier SLAs, fewer wasted cycles. 

• Fresher detection updates → fewer repeat incidents as infrastructure rotates. 

Trusted by Security Teams Worldwide 

ANY.RUN is a part of daily security operations across industries where mistakes are expensive and downtime isn’t an option. 

Today, organizations rely on ANY.RUN in real production environments across: 

• 3,102 IT & technology companies 

• 1,778 financial institutions 

• 1,354 manufacturing organizations 

• 919 healthcare providers 

• 1,059 government entities 

• 460 energy companies 

• 347 transportation & logistics businesses 

This trust shows up consistently in independent reviews: 

• 4.7 / 5 on G2 — praised for speed, visibility, and day-to-day usability 

• 4.8 / 5 on Gartner Peer Insights — recognized for real-world impact on SOC performance 

This broad adoption across regulated, high-risk industries reinforces one thing: 
ANY.RUN scales not just technically, but operationally; across teams, regions, and security maturity levels. 

If teams in finance, healthcare, government, and critical infrastructure rely on it daily, it’s because it delivers results where stakes are highest. 

Why These Results Repeat Across Teams and Industries 

These outcomes show up in very different environments for one reason: high-performing teams don’t treat investigations as one-off incidents. They run a consistent, repeatable way of working that turns uncertainty into clarity fast and keeps that clarity flowing across the whole operation. 

What makes the difference: 

• Decisions are based on evidence, not assumptions 
  Teams don’t wait for “maybe” signals to become obvious. They confirm what’s happening early, so risk doesn’t quietly grow in the background. 

• Context reaches the right people at the right moment 
  Frontline triage gets enough clarity to close routine cases confidently, while deeper work is reserved for what truly needs it. 

• Response stays steady even when attackers change tactics 
  As infrastructure rotates and methods evolve; teams don’t fall back into manual chase mode. They keep coverage current and avoid repeating the same work. 

• Workflows are built for scale, not heroics 
  The process holds up under load, across shifts, and across customers, which is why SLAs stabilize and burnout drops. 

That’s why the same gains keep showing up: faster decisions, less noise, and fewer business-impacting incidents. 

Ready to See What Results Like These Look Like in Your Environment? 

Every SOC operates under different constraints; tools, team size, industry pressure, compliance rules. What doesn’t change is the cost of slow decisions, unnecessary escalations, and incidents that reach the business before they’re contained. 

The teams featured here didn’t rebuild everything from scratch. They focused on shortening time-to-verdict, giving frontline staff better clarity, and keeping detection current as attacks evolved. The result was less noise, steadier SLAs, and fewer incidents turning into business problems. 

If you’re weighing whether a change will actually move the needle, not in theory, but in daily operations, these results show what’s possible when security work becomes faster, clearer, and easier to scale. 

See what faster decisions look like in practice, run your SOC with ANY.RUN. 

About ANY.RUN 

ANY.RUN is a core part of modern security operations, helping teams make faster, more confident decisions across Tier 1, Tier 2, and Tier 3. It fits into existing workflows without friction and strengthens the entire investigation lifecycle; from early validation to deeper analysis and ongoing threat awareness. 

By revealing real attacker behavior, adding context where it’s missing, and keeping detections aligned with how threats actually evolve, ANY.RUN helps SOCs reduce noise, shorten response times, and limit business impact. 

Today, more than 600,000 security specialists and 15,000 organizations worldwide rely on ANY.RUN to accelerate triage, cut unnecessary escalations, and stay ahead of phishing and malware campaigns that don’t stand still. 

FAQ

The post SOC & Business Success with ANY.RUN: Real-World Results & Cases  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More