Link11 is fully committed to Europe and is opening a Customer Excellence Hub in Lisbon
Frankfurt am Main, Germany, 27th May 2026, CyberNewswire
Hackread – Cybersecurity News, Data Breaches, AI and More – Read More
My eye doctor got my computer prescription wrong, and AI helped me fix it
An eye exam produced a good distance prescription and a terrible computer prescription. Here’s how AI helped decode the numbers and expose the mismatch.
Latest news – Read More
SecurityWeek to Host AI Risk Summit August 11-12 at the Ritz-Carlton, Half Moon Bay
Now in its third year, the AI Risk Summit is the leading conference that brings together CISOs, security leaders, AI researchers, developers, policymakers, and enterprise risk professionals.
The post SecurityWeek to Host AI Risk Summit August 11-12 at the Ritz-Carlton, Half Moon Bay appeared first on SecurityWeek.
SecurityWeek – Read More
Inside ANY.RUN’s 10-Year Evolution: An Interview with CEO Aleksey Lapshin
What happens when a malware analyst decides to build a product he always wished he had? The case of ANY.RUN tells us that ten years later it may turn into an industry-standard solution, adopted by 74 Fortune 100 companies.
Celebrating a decade of ANY.RUN, CEO Aleksey Lapshin shared his perspective on the evolution of the company, the reality of AI in cybersecurity, and why human expertise remains the most valuable asset in the age of AI.
Key Takeaways
- According to Aleksey Lapshin, ANY.RUN was created to solve real problems analysts faced every day: slow investigations, fragmented tools, and inefficient workflows.
- Lapshin believes that despite rapid AI adoption, human expertise and manual verification are becoming even more valuable in modern SOC operations.
- One of ANY.RUN’s biggest competitive advantages is its community-driven threat intelligence built from thousands of daily analyst investigations.
- The company’s long-term vision is to create a faster, less stressful, and more effective environment for cybersecurity teams.
- The CEO argues that AI will not replace cybersecurity professionals; instead, it will increase the need for skilled analysts capable of validating and responding to complex threats.
The Foundation of ANY.RUN
Q: Going back a decade, what was the initial spark that led to the creation of ANY.RUN in 2016?
Aleksey Lapshin: It started as a very personal mission. I worked as a malware analyst and the tools we had at the time were simply ineffective for the reality of the job. Most antiviruses only gave a simple “yes/no” verdict, while my actual task was to deeply research malware behavior and extract valuable IOCs. Analyzing just one sample and getting meaningful results often took an entire day of manual work.
I wanted to build a malware sandbox that removed that manual routine of setting up your virtual environment, gave you full interactive control over the VM, and brought the whole process to a unified standard. The main goal was simple: get results fast. I wanted to see what a threat actually does in real time, within seconds of detonating the malware, instead of waiting 10+ minutes for a standard sandbox report.
Q: How did you go from building a personal project to launching a full product?
At first, it was just my personal project that I kept using and improving. Then I thought maybe others could use this too. I made a basic landing page, spent $100 on Google Ads, and quickly got more than 100 requests, many from security professionals at large enterprises. The unexpected response inspired me to try to make the sandbox available to the public. But for that, I needed more hands on deck.
We started with just two people, then grew to three. With this small team, we launched the first public version and even built the very first paid version. For a long time, I personally handled marketing, spoke with potential customers, and closed sales myself. Thanks to that hands-on approach, we reached operational profitability almost from the very beginning.
We also made a strategic decision to offer a free tier, which was instrumental in building a community around the service early on. Instead of being a solution forced on teams from the top down by management, SOC teams began to adopt us because the analysts themselves found it faster and more effective than anything else they had. This allowed the product to grow naturally within organizations.
Evolution and the Modern SOC
Q: How have the company’s goals evolved over these 10 years?
For a long time, we grew by focusing almost exclusively on the analyst’s technical needs and their individual workspace. Today, we’ve shifted to looking at the landscape from two sides: the analyst and the business.
Our goal now is to ensure that ANY.RUN’s solutions provide the value businesses and MSSPs need. That means not just helping analysts investigate threats, but helping organizations reduce detection gaps that directly translate into business risk, incident impact, and operational disruption.
Q: In small versus large SOCs, how does the role of ANY.RUN differ?
It is hard to speak for every SOC, but I can give you the most common scenarios. In smaller teams where a SOC might not even be fully formed, ANY.RUN’s solutions often become the primary, central workstation. The analysts there are usually handling Tier 1, 2, and 3 duties all at once. They need a “do-it-all” environment where they can perform manual investigations and get immediate results.
In large-scale enterprise SOCs, where there is a massive and constant flow of alerts, we integrate into a much larger chain of products like SIEM, SOAR, and EDR to provide actionable context. But no matter how advanced the company’s security or how strong their automation is, manual verification is still essential, even more so in the age of AI.
Attackers now can generate countless sophisticated and convincing phishing variants in seconds. This is exactly why ANY.RUN’s solutions are where SOC teams go to get the real ground truth, remove uncertainty, and make final decisions about risk.
“No matter how advanced the company’s security or how strong their automation is, manual verification is still essential, even more so in the age of AI.”
Q: What is the ideal place for ANY.RUN in a modern SOC environment?
I’ve always wanted it to be a place where people actually feel comfortable and confident working, which is rare in this industry. Most security solutions can be sterile, exhausting, and quite dull.
I aim for ANY.RUN to be a burnout-free environment SOC teams actually want to return to because it reduces their fatigue and gives them certainty in their findings. We want to be recognized as one of the primary, essential locations in a SOC, and I’m really happy that clients confirm in their reviews that we’re succeeding in this. But we also know that it requires us to keep working hard to maintain that level of trust and responsibility.
“I aim for ANY.RUN to be a burnout-free environment SOC teams actually want to return to.”
Philosophy of Growth
Q: What were the biggest personal milestones and challenges for you during this journey?
I don’t really view our history through “big bang” milestones or singular moments of triumph. To me, the most important part of the journey has been the constant, incremental improvements we make every single day.
That said, there is one moment that really stands out to me. Just a couple of months after we released the paid version, the first company reached out and told us they wanted to buy an ANY.RUN subscription for 7 users on a three-year contract. It felt both exciting and overwhelming. I wasn’t sure if we were ready for that level of responsibility, but it made me very proud. It was the real validation that we were solving a genuine pain point for companies.
As for the biggest challenge, I would say it is always the next step right in front of us, especially since we usually have multiple development streams running at the same time.
Q: What’s your personal philosophy on growth and success after 10 years of building the company?
I don’t believe in the traditional cycle of setting a target, reaching it, and then stopping to rest before the next one. What works for me is simply moving forward step by step. I’m always in the middle of achievements, which means less rest but also constant progress. When you look back, you realize how far you’ve come.
The AI Landscape and ANY.RUN’s Biggest Competitive Advantage
Q: With AI dramatically lowering the bar for software development, what is ANY.RUN’s biggest competitive advantage today?
Modern AI can indeed recreate an interface or mimic basic detection logic, but it cannot copy ten years of community trust and human-driven telemetry.
Our real capital isn’t just the software, it’s the data moat we’ve built over a decade of focusing on the real needs of security professionals. Every day, more than 10,000 companies contribute valuable data to this ecosystem. Their analysts investigate the latest malware and phishing in the sandbox, which generates large volumes of unique telemetry on active threats.
In theory, AI could build a clone of our sandbox that looks just as good, or even better, but without the community-sourced threat data, it would be like a beautiful car with no gas.
Our “gas” is over 35,000+ daily human-driven investigations every day, creating a continuous stream of real-world threat intelligence. This data directly translates into faster detection, better context, and earlier understanding of emerging attacks for our paid clients, giving them a clear advantage against attackers.
That’s why we’ve been investing in and supporting the ANY.RUN community for 10 years, and it continues to be our number one priority.
“AI could build a clone of our sandbox that looks just as good, or even better, but without the community-sourced threat data, it would be like a beautiful car with no gas.”
Q: What’s your take on the idea of fully autonomous AI SOCs?
I see AI as a double-edged sword. It drives rapid innovation on both the attacking and defending sides of the cybersecurity landscape.
Yet, attackers will always be faster because defense must be massive and cover everything, while an attack only needs one successful vector to succeed. Criminals don’t just target systems; they target people. In a phishing attack, for example, they can leverage AI to craft a message designed to bypass another AI so that a human will eventually click on it.
Because of this reality, I believe the idea of a fully autonomous SOC where AI simply fights cyber threats without any human involvement is totally unrealistic. That is exactly the reason why, with the rise of AI threats, manual verification of alerts by SOC analysts is actually becoming more valuable than ever before. You need a person to validate what the AI might miss or what the attacker has specifically designed to appear benign to an automated filter.
Of course, many basic attacks can already be largely handled by AI, especially at the detection and initial triage stages. But as more attackers adopt AI, the volume of attacks grows exponentially, so even with higher automation, the total amount of work requiring human validation is likely to increase rather than decrease.
“With the rise of AI threats, manual verification of alerts by SOC analysts is becoming more valuable than ever before.”
Q: What are the main risks for companies that are trying to replace their Tier 1 analysts with AI?
I would say there are two core risks that companies often overlook.
First, as I said, if you rely solely on AI, attackers will eventually adapt their methods specifically to bypass those filters, and if you’ve removed the human element, you have no last line of defense.
Second is the “knowledge erosion” problem. Tier 1 is the essential training ground for future specialists; if you automate it entirely, where do your Tier 2 and Tier 3 analysts come from in a few years? You’ll eventually end up with a workforce that lacks foundational experience and “gut feeling” because they never “grew up” handling those initial, real-world alerts. Over time, this creates a structural risk where organizations lose their ability to investigate, contain, and respond to incidents effectively.
Q: Would you say the cybersecurity industry in 2026 actually needs more people than ever before?
Absolutely, and thinking otherwise is a self-delusion. While AI helps us automate certain tasks, it also allows attackers to scale the volume and complexity of their strikes exponentially.
AI doesn’t reduce the need for people in security. It increases the number of problems only people can solve. We’ve found that with the arrival of AI, the industry actually requires more skilled people to deal with the new categories of problems that AI-driven attacks are creating.
“AI doesn’t reduce the need for people in security. It increases the number of problems only people can solve.”
Looking Forward
Q: As you look forward, what are the key strategic tasks for ANY.RUN in the coming years?
Our main goal right now is to provide a powerful decision-making layer for SOC and MSSP teams. We want to bring all critical information together so analysts can move from alert to a final decision as quickly and easily as possible.
We will continue doubling down on our biggest advantage, the unique data we have, while expanding detection capabilities, scaling our infrastructure, and ensuring our solutions deliver real value to both analysts and the business.
Get Special ANY.RUN Offers Before May 31
To mark its 10th anniversary, ANY.RUN is offering special conditions for SOCs, MSSPs, and enterprise security teams that want to strengthen phishing analysis, threat intelligence, and response readiness.
Trusted by security teams worldwide, including 74 Fortune 100 companies, ANY.RUN helps organizations bring earlier threat visibility into the workflows where response decisions happen.
Until May 31, teams can access anniversary offers across key ANY.RUN solutions, including:
- Interactive Sandbox‘s Enterprise Suite plan to safely analyze suspicious links, files, emails, and phishing pages with behavior-based visibility, with bonus seats and exclusive pricing available for teams.
- Threat Intelligence’s Complete plan with extra months to help teams connect single cases to related infrastructure, IOCs, campaigns, and broader threat activity.
This is a great opportunity to close social engineering blind spots, reduce gray-zone investigations, and give teams clearer evidence before trusted workflows turn into exposure.
About ANY.RUN
ANY.RUN delivers cybersecurity solutions designed to support security operations in businesses and organizations. The company’s goals is to help security teams understand threats faster, make informed decisions, and use threat intelligence across detection, investigation, and response workflows in SOCs and MSSPs.
The company’s solutions include Interactive Sandbox for enterprise-scale malware and phishing analysis, as well as ANY.RUN Threat Intelligence solutions accumulating investigation data from 15,000+ SOCs for instant enrichment and early threat detection.
ANY.RUN is SOC 2 Type II attested, reflecting strong security controls and a commitment to protecting customer data. For SOCs, MSSPs, and enterprise teams, ANY.RUN helps reduce investigation uncertainty, improve triage speed, and turn threat analysis into clear, actionable evidence.
The post Inside ANY.RUN’s 10-Year Evolution: An Interview with CEO Aleksey Lapshin appeared first on ANY.RUN’s Cybersecurity Blog.
ANY.RUN’s Cybersecurity Blog – Read More
LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers
The attack was claimed by a hacktivist group, but evidence showed it used infrastructure linked to Iranian government threat actors.
The post LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers appeared first on SecurityWeek.
SecurityWeek – Read More
GlassWorm Botnet Disrupted
Security firms took down all four command-and-control (C&C) channels used by the GlassWorm malware.
The post GlassWorm Botnet Disrupted appeared first on SecurityWeek.
SecurityWeek – Read More
‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems
Malicious repositories and disguised symlinks can trick AI coding agents into silently installing attacker-controlled MCP servers capable of stealing secrets, compromising CI pipelines, and deploying malicious code.
The post ‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems appeared first on SecurityWeek.
SecurityWeek – Read More
The Credential Crisis: How Stolen Credentials Defeat Modern Security
As AI accelerates phishing, session hijacking, and credential abuse, security teams are racing to close the gap between attacker speed and defensive response.
The post The Credential Crisis: How Stolen Credentials Defeat Modern Security appeared first on SecurityWeek.
SecurityWeek – Read More
Lastwall Raises $11.5 Million for Quantum-Resilient Identity Platform
The new funding, led by BDC Capital’s StrongNorth Fund, will accelerate Lastwall’s North American expansion.
The post Lastwall Raises $11.5 Million for Quantum-Resilient Identity Platform appeared first on SecurityWeek.
SecurityWeek – Read More
Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake
- Security teams need high-quality, labeled datasets to train threat hunters and incident responders, validate detection logic, and develop robust analytic models.
- EvidenceForge helps teams overcome the limitations of anonymized or stale public datasets, while avoiding the cost and complexity of setting up real infrastructure and performing manual attack simulations to create their own.
- The tool incorporates sophisticated timing models and assigns specific roles to users and systems, generating realistic malicious activity, background noise, and “red herrings” to optimize data realism.
- The tool generates correlated logs across 20+ Windows, Linux, and network monitoring formats using a canonical event model that ensures causal and temporal consistency.
Good data is hard to find… and to create
A lot of important work in security depends on having realistic log data to work with, and a lot of that work gets blocked, watered down, or quietly skipped because the data just isn’t available. The use cases come up constantly: teaching threat hunters, incident responders, and detection engineers with datasets that have known ground truth; validating that a detection fires on the right activity without drowning in false positives; and training ML models that need labeled, balanced, multi-source telemetry at scale.
These are different problems with the same root cause. You need realistic, labeled security logs and you can’t get them easily. The options are limited:
- Real production telemetry is a compliance problem. Public datasets are often so heavily anonymized they no longer resemble the original log sources. The LANL dataset and OpTC are well-known examples of data scrubbed to the point of being generic event representations rather than actual telemetry. What isn’t anonymized is stale, narrow, and over-recycled.
- You can generate data yourself using attack simulation frameworks like Atomic Red Team or MITRE Caldera, but that requires real infrastructure, is time-consuming to operate, and scales poorly when you need variety.
- You can hire a red team, which trades complexity for money but still takes weeks and produces only the specific scenario they ran.
Synthetic generators seem like an obvious solution and many existing ones are genuinely useful tools, but they share a common architectural limitation: They generate events independently, one format at a time, with no shared state across log sources. The result is datasets where events don’t tell a coherent story. For example, a process in Sysmon doesn’t connect to the same process in standard Windows logs, or a network logon doesn’t leave a consistent connection trace. More capable tools support attack chains and MITRE ATT&CK mapping, but even then, they generate individual events rather than simulating something that happened, with all the prerequisite and consequent evidence that real activity would produce. Realistic background noise is largely absent.
What analysts detect when they call data synthetic is the absence of a coherent causal story. The logs don’t line up because they emit each log entry independently from the others, and they are not modeling a series of connected events.
The answer: A new kind of synthetic data
EvidenceForge is a new open-source project from Cisco Talos that approaches the problem differently. It features a single canonical event model, causal ordering, realistic background noise, and AI-assisted scenario authoring. The result is a synchronized dataset across 20+ log formats (Windows, Linux, network, and endpoint detection and response [EDR] telemetry), complete with ground truth documentation and an analyst briefing.
One honest note: No purely synthetic dataset will fool a seasoned analyst in every case, but that’s okay. The goal is fidelity that’s good enough to be useful, not something that’s indistinguishable from production.
The core idea: One event, many formats
Most synthetic log generators are a collection of independent emitters. Each one knows how to produce its own format but doesn’t share state with the others. You can see the seams the moment you cross-reference across sources.
EvidenceForge inverts that. Every piece of evidence flows from a single canonical SecurityEvent object. That object carries a timestamp and event type, plus over 30 composable context objects populated as needed: ProcessContext (PID, parent PID, image, command line), NetworkContext (src/dst IP and port, Zeek UID, shared across Zeek, EDR, and SNORT®), AuthContext (username, LogonID, logon type, result), DnsContext and HttpContext (protocol-layer detail that fans out into the corresponding Zeek log types), and many more. Emitters read only the fields relevant to their format.
The consequence of shared contexts is that emitters cannot disagree. There is one PID, one LogonID, one timestamp, and one Zeek UID. The engine is also OS-aware: Windows hosts produce Security Events and Sysmon while Linux hosts produce syslog and bash history, each according to the OS assigned to each host in the scenario.
All of this is driven by a scenario configuration file: a YAML document describing the environment (hosts, users, network topology) and an optional attack storyline. The engine reads that file and produces the correlated dataset.
What the engine produces
From a single scenario, EvidenceForge generates several correlated log formats:
- Windows Security Events (30 event IDs covering authentication, process lifecycle, Kerberos, persistence, account management, and more)
- Sysmon (10 event IDs)
- EDR/XDR telemetry
- Linux syslog
- bash history
- Zeek logs in JSON format
- Snort IDS alerts
- Firewall logs
- Web server access logs
- Forward HTTP proxy logs
The exact output logs depend on a combination of the components in the simulated environment, and which log sources you may have opted to disable.
Every attack scenario also produces two companion documents.
- “ENVIRONMENT.md” is an analyst briefing consisting of organizational context, network layout, user roles, naming conventions — everything an analyst would need before diving into the logs, with zero information about the attack itself.
- “GROUND_TRUTH.md” documents exactly what happened including a narrative, a timeline, and key IOCs.
Causality, not just sequence
Real logs are both temporally and causally ordered. Before a domain logon, there’s a Kerberos TGT, then a TGS. Before a TCP connection to a hostname, there’s a DNS query. This is the physics of how the protocols work.
EvidenceForge ships with a composable rule engine that auto-generates prerequisite events with realistic timing offsets so that each event sits exactly where an analyst would expect to pivot to it:
- A logon in the scenario expands to the Kerberos exchange that made it possible.
- A connection to a named host gets the DNS resolution inserted beforehand.
- A privileged admin command generates downstream audit events.
Network visibility is a first-class concept
Most synthetic generators are too visible, meaning that every connection gets a log, regardless of whether a sensor would have seen it. Real networks don’t work that way. Traffic between hosts on the same VLAN may never cross a SPAN port. East-west traffic in a segmented network may be invisible to perimeter sensors. A TAP at the internet edge sees outbound traffic but nothing internal.
EvidenceForge lets you declare sensor placement in the scenario: SPAN or TAP, monitored segments, and direction. The engine determines which connections each sensor could realistically observe and only emits network logs where they’d actually appear. If your environment has a monitoring gap, the generated data has that same gap, which is exactly the kind of thing analysts need to learn to reason about.
AI co-develops the story; a script generates the evidence
The hard part of realistic synthetic data is scenario design, not generation. Describing a coherent attack lifecycle with the right tactics, techniques, and procedures (TTPs); realistic sequencing; and plausible actor behavior requires research and protocol knowledge most people don’t carry in their heads.
EvidenceForge addresses this with Claude/Codex skills. You bring intent (an attack type, an environment, a training objective), the AI brings research and technical scaffolding (a guided interview, MITRE ATT&CK TTP research), and together you collaboratively develop the attack narrative, resulting in a validated YAML scenario file.
The YAML is version-controllable, shareable, and editable. Once it exists, generation is entirely deterministic: a Python script reads the config and produces all the correlated log evidence.
This separation is the optimal balance of what each technology is good at. AI excels in narrative coherence, TTP research, and protocol knowledge. A deterministic script excels at the thousands of cross-referenced field values, causal prerequisite chains, and inter-format consistency checks that make up a realistic dataset. This would overwhelm even a capable LLM at scale, and hallucinated field values or subtle inconsistencies would undermine the whole point.
A typical scenario costs pennies in API calls to co-develop, and the data generates in seconds or minutes rather than the hours or days an LLM-based approach would require. EvidenceForge also produces identical output every run because randomness is seeded. Built-in validation checks the scenario for schema correctness and cross-reference integrity before generation runs, and the AI can automatically fix most errors it finds.
Making the background convincing
Attack events are only useful if analysts have to work to find them. Noise quality matters as much as signal quality.
EvidenceForge’s baseline engine generates several types of realistic background noise, including:
- Legitimate lateral movement patterns (backup agents, monitoring tools, AD replication, application-to-database traffic)
- User and application-driven network activity (web browsing, SMB file share access, RDP sessions, scheduled service polling)
- Per-user diversified command pools, depending on user role
- Red herrings (suspicious-looking events or patterns that are benign)
Timing is just as important as content. Volume-level realism without burst-level texture still looks synthetic. EvidenceForge uses three complementary timing models:
- A Hawkes process for user activity, a self-exciting model where each event makes the next more likely for a short window, then decays, matching how people actually work in bursts
- A periodic envelope for large-scale structure (Monday login storms, Friday drop-off, and near-zero weekends)
- Periodic intervals plus jitter for modelling recurring automated events like scheduled tasks, background updates, and other system and service traffic
Most timing details are exposed in the scenario or engine config files, so you can tweak them to make them as realistic as you like for your simulated environment.
Getting started
EvidenceForge is available on GitHub. Clone the repo and follow the install instructions in the README.
The core experience is a guided conversation. Start the /eforge:scenario command and describe what you want. You can be as specific or as vague as you like. Bring a fully formed scenario and the AI helps translate it into a valid configuration; bring a rough idea and it asks the right questions, fills in the gaps, and makes suggestions until you have something technically coherent and satisfyingly realistic. From there, the skill leads you through validation, generation, and a brief automated data quality evaluation. You come out the other end with a complete, correlated dataset and companion documents. A full CLI is also available for scripted workflows.
What will you build?
EvidenceForge removes the data bottleneck. The question becomes what you do with that. The following are just a few examples:
- Build a SOC analyst training program with scenarios tailored to your environment.
- Test detections against controlled, labeled datasets before they go near production. See whether they fire on the attack and how they behave against realistic noise.
- Generate the labeled training data your ML model needs.
- Stress-test a new SIEM or detection pipeline against volume and variety you control.
- Create repeatable practice exercises that can be regenerated on demand after tuning.
The scenarios themselves are shareable artifacts. A scenario developed for one team can be shared, adapted, or built on by others. The right mental model is high-fidelity training and testing data — not a production telemetry substitute — but within that framing, the use cases are broad.
Cisco Talos Blog – Read More