ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split
Artifacts and tooling for the new Enterprise MITRE ATT&CK matrix tactics, distilled from the field.
Read the full story on Sophos NewsHave you worked with this?
The story is what was announced. Nobody has discussed it yet, so if it touches your team, a short post about what you’ve seen helps the next reader.
More from Sophos
Recent updates from Sophos, so you can tell whether this is a one-off or part of a pattern.
The industry turned XDR and SIEM into categories. Sophos turned them into outcomes.
Sophos Next-Gen SIEM, now generally available as part of Sophos Fusion, brings security operations and compliance together through shared context.
Cisco Secure Email Gateway vulnerability (CVE-2026-76461) in active exploitation
Messageboards are all they need
This article was first published on LinkedIn.
More in Security
What other companies in Security are doing. The category page shows who’s active, side by side.
Threat Actors Use Google Ads To Target Ledger Users
In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes. There, a fake…
Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
Two Things Every Cyber Asset Attack Surface Management (CAASM) Tool Needs to Get Right
Cyber Asset Attack Surface Management (CAASM) solved a significant problem. Security teams can now say with confidence what they own. But, two things separate a CAASM tool that stops there from one that actually moves the needle on risk. The first is what the inventory itself carries. The second is what it connects to. 1. An inventory needs to do more than list what exists A list of assets is…
Agents can now set up your website’s security with Turnstile Spin
Misconfiguring Turnstile by skipping backend validation leaves sites exposed to bots. Turnstile Spin fixes incomplete setups by using your preferred AI coding agent to wire up server-side verification.