# Incident response Cybersecurity discipline for mitigating security-policy violations and managing detection, response, and recovery activities. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How Marathon Incidents Expose Organizational Fragility and Require Structured Incident Response DevFeed: [How Marathon Incidents Expose Organizational Fragility and Require Structured Incident Response]() Original publisher: [Read original article]() Author: Vanessa Huerta Granda Published: 2026-09-17T09:30:00Z Content type: article Language: en Sources: [InfoQ]() Topics: [incident](), [Incident response]() Tags: [devops](), [incident](), [incident-response](), [infoq](), [limits](), [organizational](), [outages](), [presentation](), [qcon-san-francisco-2026](), [qcon-software-development-conference](), [real-world](), [stream-incidents](), [structured](), [system](), [transcripts]() ### AI overview Vanessa Huerta Granda discusses how prolonged incidents reveal gaps between planned work and work as performed. Drawing on real-world scenarios, the presentation examines organizational fragility, human limits, system interdependencies, and the need for structured, humane, cross-functional incident response. ### Source excerpt Vanessa Huerta Granda explains how marathon incidents expose the gap between work as imagined and work as done. Drawing from real-world scenarios, she shares how complex outages reveal organizational fragility, human limits, and system interdependencies--and why incident response requires structured endurance, humane rotations, and holistic cross-functional coordination. By Vanessa Huerta Granda ## Architecting a secure landing zone in the AWS European Sovereign Cloud DevFeed: [Architecting a secure landing zone in the AWS European Sovereign Cloud]() Original publisher: [Read original article]() Author: Pablo Pagani Published: 2026-09-16T21:20:48Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services](), [Cloud](), [Architecture & Design](), [AWS IAM](), [Infrastructure as code](), [CI/CD](), [SIEM, Security](), [Incident response]() Tags: [advanced-300](), [aws](), [aws-identity-and-access-management-iam](), [ci-cd](), [cloud](), [eu](), [europe](), [incident-response](), [infrastructure-as-code-iac](), [partition](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to]() ### AI overview This article explains how to architect a secure, scalable landing zone in the AWS European Sovereign Cloud. It describes the aws-eusc partition boundary and covers governance, identity, logging, data protection, network design, CI/CD, artifact distribution, and incident response. ### Source excerpt The AWS European Sovereign Cloud is a new, independent cloud for Europe, physically and logically separate from existing AWS Regions and operated within the European Union (EU). It provides the same services, features, and APIs as AWS commercial Regions, but runs as a distinct AWS partition (aws-eusc), with its own control plane, AWS Identity and [...] ## Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face DevFeed: [Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face]() Original publisher: [Read original article]() Author: Tom Hegel Published: 2026-09-16T10:00:34Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [Threat Research](), [Incident response](), [hugging face](), [OpenAI](), [ChatGPT](), [spaces](), [Flask](), [OAuth](), [HTTP]() Tags: [agentic-ai](), [agents](), [chatgpt](), [flask](), [http](), [hugging-face](), [incident-response](), [oauth](), [openai](), [research](), [spaces](), [token]() ### AI overview SentinelLABS traces activity associated with two Hugging Face accounts, 0Time and Nyx9, that appears to extend OpenAI's published chronology. The report describes relay-code commits, a workbook containing unexecuted-looking external probes, and a Flask-wrapped tool that could potentially provision ChatGPT identities or OAuth credentials if deployed and invoked. ### Source excerpt Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline. ## A working incident response model for GPU clouds DevFeed: [A working incident response model for GPU clouds]() Original publisher: [Read original article]() Author: Sridhar Rajarao Published: 2026-09-12T00:00:00Z Content type: article Language: en Sources: [Sridhar Rajarao]() Topics: [incident](), [Incident response](), [GPU](), [Monitoring](), [Tooling]() Tags: [communication](), [debugging](), [gpu](), [gpu-cloud](), [grafana](), [incident](), [incident-management](), [incident-response](), [jira](), [management](), [on-call](), [operations](), [ownership](), [pagerduty](), [review](), [slack](), [sre]() ### AI overview This article presents an incident response model for GPU clouds and other customer-facing infrastructure businesses. It emphasizes preparation, named ownership, meaningful alert paths, incident command, separation of technical work from customer communication, and post-incident learning. It argues that tools such as PagerDuty, Jira, Grafana, and Slack are useful only within a clear operating model. ### Source excerpt The tools matter, but they only work when they sit inside a clear operating model: ownership, signal, command, communication, and learning. ## Prepare for the Cyber Resilience Act's 24-hour reporting deadline DevFeed: [Prepare for the Cyber Resilience Act's 24-hour reporting deadline]() Original publisher: [Read original article]() Author: Amit Shalem Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [Vulnerabilities](), [open-source-security](), [Incident response]() Tags: [compliance](), [cybersecurity](), [europe](), [features](), [sbom](), [security](), [supply-chain](), [supply-chain-security](), [vulnerabilities]() ### AI overview The article explains the Cyber Resilience Act requirement for manufacturers to report actively exploited product vulnerabilities within 24 hours of becoming aware of them. It presents continuous software supply-chain detection, dependency scanning, SBOM monitoring, KEV status, EPSS scores, and container scanning as ways GitLab can help organizations identify and prioritize reportable risks. ### Source excerpt Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act (CRA), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats. The most stringent requirements under the CRA apply to the manufacturers that make those products, from large software vendors to companies shipping connected hardware. The challenge a business faces to stay compliant is not the filing itself. It is finding out fast enough that a vulnerability in something you shipped is being actively exploited in your software supply chain. The 24-hour clock starts the moment you become aware, this is why detection is so important. Continuous detection is an engineering solution rather than a one-off compliance one. GitLab's software supply chain security capabilities are built to help you find active exploitation in what you shipped, automatically and continuously. This article walks through four questions you should ask yourself about your own pipeline's continuous detection solution today. Reporting requirement starts in September 2026 Beginning September 11, 2026, manufacturers have to report an actively exploited vulnerability within 24 hours of becoming aware of it. The reporting runs in three stages each submitted simultaneously to the European Union Agency for Cybersecurity (ENISA) and to the Computer Security Incident Response Team (CSIRT) designated as coordinator. Early warning, within 24 hours of becoming aware of the actively exploited vulnerability. A short first alert that exploitation is happening. You are not expected to know the full scope of impact or the fix yet. Notification, within 72 hours. A fuller account, covering what is affect ## Thrown into the SOC: A Black Hat First-Timer's Story DevFeed: [Thrown into the SOC: A Black Hat First-Timer's Story]() Original publisher: [Read original article]() Author: Danny Rodriguez Published: 2026-09-07T15:00:54Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Incident response](), [incident](), [dashboards]() Tags: [agentic](), [ai](), [ai-agents](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cisco-xdr](), [cybersecurity](), [dashboards](), [duo](), [firewall](), [incident](), [incident-response](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [tools](), [workflows]() ### AI overview A first-time SOC analyst reflects on a short Black Hat NOC rotation, focusing on evidence-based alert triage, uncertainty, and how AI agents can help investigators ask better questions. ### Source excerpt A Black Hat SOC analyst shares how agentic workflows, Splunk ES, packet evidence, and human mentorship accelerated triage & investigation in the NOC/SOC. ## Incident response guide for AWS CloudTrail investigations - Part 2 DevFeed: [Incident response guide for AWS CloudTrail investigations - Part 2]() Original publisher: [Read original article]() Author: Oscar Diaz Published: 2026-09-03T21:15:53Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Incident response](), [AWS CloudTrail](), [AWS IAM](), [web applications]() Tags: [advanced-300](), [amazon-bedrock](), [aws](), [aws-cloudtrail](), [aws-identity-and-access-management-iam](), [best-practices](), [incident-response](), [security-blog](), [security-identity-compliance]() ### AI overview An incident-response guide for investigating AWS CloudTrail events through a multi-stage attack scenario. It traces an SSRF vulnerability on an EC2-hosted web application to IMDSv1 credential harvesting, IAM activity, and unauthorized Amazon Bedrock access across Regions. ### Source excerpt In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed through AWS CloudFormation using exposed AWS Management Console credentials. We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events. In this second [...] ## Incident response guide for AWS CloudTrail investigations - Part 1 DevFeed: [Incident response guide for AWS CloudTrail investigations - Part 1]() Original publisher: [Read original article]() Author: Oscar Diaz Published: 2026-09-03T21:15:39Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS CloudTrail](), [Incident response](), [AWS IAM]() Tags: [advanced-300](), [analysis](), [aws-cloudtrail](), [best-practices](), [guide](), [incident-response](), [logs](), [security](), [security-blog](), [security-identity-compliance]() ### AI overview A practical guide to investigating suspicious AWS activity through CloudTrail logs. It covers scenarios such as cross-account unauthorized access, cryptocurrency mining, and AI service abuse, with investigation questions, annotated logs, and preventive lessons. ### Source excerpt AWS CloudTrail logs contain the evidence you need when investigating suspicious activity in your AWS environment, but knowing which fields matter and how to interpret them can mean the difference between surface-level analysis and uncovering the full scope of an incident. This guide walks you through real-world scenarios, showing you how to analyze CloudTrail events [...] ## Cybersecurity IR Workshop: The workshop you shouldn't miss DevFeed: [Cybersecurity IR Workshop: The workshop you shouldn't miss]() Original publisher: [Read original article]() Author: Microsoft Defender Experts Cybersecurity Incident Response Published: 2026-09-01T18:55:35Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [Incident response](), [incident]() Tags: [cloud](), [cybersecurity](), [dart](), [defender](), [identity](), [incident](), [incident-response](), [logs](), [microsoft](), [resilience](), [security](), [telemetry]() ### AI overview Microsoft's DART describes a scenario-driven incident-response readiness workshop that lets teams test their plans against simulated security incidents. It covers detection, investigation, containment, communication, threat hunting, and the use of tools, logs, and telemetry under pressure. ### Source excerpt Cyber resilience starts before a crisis. Gain practical insights from DART to strengthen readiness and response. The post Cybersecurity IR Workshop: The workshop you shouldn't miss appeared first on Microsoft Security Blog. ## Automated Incident Response: Nobody Should Be the Scribe DevFeed: [Automated Incident Response: Nobody Should Be the Scribe]() Original publisher: [Read original article]() Author: Ryan Taylor Published: 2026-08-25T00:00:00Z Content type: opinion Language: en Sources: [Harness Blog]() Topics: [incident](), [Incident response](), [Artificial Intelligence](), [Slack](), [Python](), [Shell]() Tags: [agent](), [ai](), [automated-incident-response](), [blog](), [harness](), [incident](), [incident-response](), [jira](), [product](), [python](), [shell-script](), [slack](), [teams]() ### AI overview A Harness product lead argues that incident teams should not rely on a human scribe. The article describes automated runbooks that create communication channels, video bridges, and tickets, while an AI Scribe Agent captures incident events and produces timelines, postmortems, and synchronized action items. ### Source excerpt A Harness product lead on why humans shouldn't be the status-tracking layer during incidents, and how automated summaries and postmortems replace the scribe. | Blog ## AWS Network Firewall now supports rule hit count DevFeed: [AWS Network Firewall now supports rule hit count]() Original publisher: [Read original article]() Author: Preetkumar Shah Published: 2026-08-20T18:40:20Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Firewall](), [Amazon Web Services](), [Amazon CloudWatch Logs](), [Network](), [Security](), [Amazon S3](), [log management](), [Incident response]() Tags: [amazon-cloudwatch](), [amazon-cloudwatch-logs](), [amazon-s3](), [announcements](), [aws](), [aws-network-firewall](), [compliance](), [firewall](), [incident](), [incident-response](), [intermediate-200](), [logs](), [network](), [s3](), [security](), [security-blog](), [security-identity-compliance](), [storage]() ### AI overview AWS Network Firewall now provides rule hit counts for stateful rules, using alert-log data to show how often rules match network traffic. The feature helps teams identify unused rules, support incident response, and demonstrate security-control effectiveness for compliance. ### Source excerpt As firewall rule sets grow in complexity, security teams face a common challenge: manual log analysis is used to determine which rules are actively matching traffic and which are consuming capacity without being triggered. This lack of visibility creates operational and compliance gaps. Organizations with governance policies that require removal of dormant rules after a [...] ## Identity Abuse Through Trusted Communication Channels DevFeed: [Identity Abuse Through Trusted Communication Channels]() Original publisher: [Read original article]() Author: Bill Batchelor Published: 2026-08-20T10:00:25Z Content type: article Language: en Sources: [Unit 42]() Topics: [Security](), [Authentication](), [Social engineering](), [Software as a service](), [Incident response]() Tags: [authentication](), [credential-theft](), [identity](), [identity-theft](), [incident-response](), [malware](), [mfa](), [phishing](), [remote-access-software](), [saas](), [security](), [social-engineering](), [threat-research]() ### AI overview Unit 42 examines how attackers abuse trusted enterprise communication and collaboration platforms for identity phishing, impersonation, credential theft, malware delivery and social engineering. The article describes how compromised identities can make malicious activity appear legitimate within authenticated collaboration sessions and offers recommendations for detecting and defending against these attacks. ### Source excerpt Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42. ## Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) DevFeed: [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-18T19:05:33Z Content type: article Language: en Sources: [Unit 42]() Topics: [Credential theft](), [password spraying](), [MFA](), [Microsoft](), [Incident response]() Tags: [credential-based-attacks](), [credential-theft](), [general](), [high-profile-threats](), [identity](), [incident](), [incident-response](), [mfa](), [microsoft](), [password-spraying](), [thehatman]() ### AI overview This threat brief examines large-scale credential attacks, including password spraying campaigns and claimed credential theft from Microsoft Entra tenants. It provides guidance for identifying suspicious login activity, auditing remote access logs, and hardening internet-exposed edge devices. ### Source excerpt In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42. ## 17,600 Actions: Agent Security Is a Systems Problem DevFeed: [17,600 Actions: Agent Security Is a Systems Problem]() Original publisher: [Read original article]() Author: Jin Kim Published: 2026-08-18T16:00:00Z Content type: opinion Language: en Sources: [Docker]() Topics: [AI Agent](), [Security](), [incident](), [Securing AI](), [Incident response](), [Vulnerabilities](), [Benchmark](), [benchmarking]() Tags: [agent](), [agents](), [ai](), [ai-agent](), [ai-ml](), [benchmark](), [community](), [company](), [dhi](), [docker](), [docker-ai-governance](), [docker-hardened-images](), [engineering](), [evaluation](), [hugging-face](), [incident](), [infrastructure](), [model](), [network](), [openai](), [opinion](), [persistence](), [sandboxes](), [security](), [solutions](), [systems](), [vulnerabilities]() ### AI overview The article argues that AI-agent security is a systems problem, using the OpenAI/Hugging Face incident and its approximately 17,600 attacker actions to show why human approval and ordinary alert triage cannot control persistent, high-rate workloads. It emphasizes constraining authority, credentials, network access, state, and execution across environments. ### Source excerpt The OpenAI/Hugging Face incident exposed a new challenge for AI agent security. 17,600 attacker actions show why AI agent security can't rely on human review. Explore the controls needed to constrain, observe, and govern agents at speed. ## Security incident involving an internal analytics system DevFeed: [Security incident involving an internal analytics system]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-08-17T00:00:00Z Content type: article Language: en Sources: [Dodo Payments Blog]() Topics: [incident](), [Security](), [vulnerability](), [Incident response](), [datasets](), [Open Source]() Tags: [analytics](), [compliance](), [datasets](), [incident](), [incident-response](), [open-source](), [security](), [self-hosted](), [vulnerability]() ### AI overview Dodo Payments discloses unauthorized access to a self-hosted Metabase analytics system after exploitation of CVE-2026-72898, an SQL injection flaw that bypassed authentication. The company says payment processing, card data, merchant funds, credentials, API keys, and other systems were not affected. Access was contained within hours on 16 August 2026, sessions and keys were revoked, and the vulnerability was closed by upgrading Metabase. ### Source excerpt An unauthorised party exploited CVE-2026-72898 in a Metabase instance used for internal reporting. Payments, card data, funds and credentials were unaffected. ## Designing for failure: Building resilient systems on AWS DevFeed: [Designing for failure: Building resilient systems on AWS]() Original publisher: [Read original article]() Author: Dhvani Vora Published: 2026-08-13T20:03:28Z Content type: tutorial Language: en Sources: [AWS Compute Blog]() Topics: [incident](), [Incident response]() Tags: [amazon-ec2](), [aws](), [aws-architecture-blog-resilience](), [aws-management-tools-blog-aws-resilience-hub](), [best-practices](), [cassandra](), [distributed-systems](), [hardware](), [incident](), [intermediate-200](), [kafka](), [observability](), [resilience](), [systems]() ### AI overview An AWS resilience guide examines a correlated EC2 hardware failure that took down three colocated Cassandra nodes. It covers placement groups, alarms, automated recovery, and observability patterns for distributed data systems. ### Source excerpt Learn how to prevent correlated hardware failures in distributed systems on Amazon EC2. This post walks through real incident response patterns, including Partition Placement Groups, composite alarms, automated recovery with Auto Scaling, and observability best practices. ## ClickStack and Hud bring runtime intelligence to AI-powered development DevFeed: [ClickStack and Hud bring runtime intelligence to AI-powered development]() Original publisher: [Read original article]() Author: May Walter, Hud.io Published: 2026-08-13T12:53:04Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [AI-assisted coding](), [observability](), [Model Context Protocol](), [OpenTelemetry](), [telemetry](), [Artificial Intelligence](), [Instrumentation](), [Deployment](), [Incident response](), [distributed-systems](), [clickhouse](), [log management]() Tags: [agents](), [ai](), [clickhouse](), [code](), [coding](), [deployment](), [developers](), [development](), [distributed-systems](), [engineering](), [incident](), [incident-response](), [infrastructure](), [instrumentation](), [integration](), [mcp](), [metrics](), [monitoring](), [observability](), [open]() ### AI overview ClickHouse and Hud announce an integration that combines ClickStack service-level observability with Hud's function-level runtime context for AI-assisted software development. Shared trace IDs and MCP servers help coding agents assess risky changes before deployment, monitor releases, and investigate incidents using production context. ### Source excerpt ClickStack and Hud now share trace IDs, pairing service-level observability with function-level runtime forensics so coding agents can assess risky changes before they ship, catch regressions right after deploy, and fix them with real production context. ## APNIC 62 keynotes explore automation, trust, and the future of the Internet DevFeed: [APNIC 62 keynotes explore automation, trust, and the future of the Internet]() Original publisher: [Read original article]() Author: Dan Fidler Published: 2026-08-13T05:57:46Z Content type: article Language: en Sources: [APNIC Blog]() Topics: [Automation](), [Internet](), [Network](), [networking](), [Cybersecurity](), [Incident response](), [Threat Research](), [Cloud](), [cloud-computing](), [telemetry](), [Resilience](), [Latency]() Tags: [ai](), [apnic-62](), [automation](), [cloud](), [community](), [cybersecurity](), [edge-computing](), [events](), [incident-response](), [internet](), [latency](), [network](), [networking](), [real-time](), [resilience](), [routing](), [security](), [technology](), [telemetry]() ### AI overview APNIC 62 will feature keynotes on autonomous network operations and trusted cybersecurity collaboration. The article describes automation, software-defined infrastructure, real-time telemetry, automated routing, self-healing fibre architectures, and zero-touch operations as ways to improve Internet resilience and performance, alongside the importance of cooperation among cybersecurity incident response teams. ### Source excerpt APNIC 62 will explore two essential foundations of a resilient Internet: Intelligent network automation and trusted cybersecurity collaboration. Keynotes from Amajit Gupta and Yukako Uchida offer complementary perspectives on how technology and human relationships will shape the Internet's future. ## How iFood built its agentic security platform on ClickHouse Cloud DevFeed: [How iFood built its agentic security platform on ClickHouse Cloud]() Original publisher: [Read original article]() Author: ClickHouse Published: 2026-08-12T15:29:05Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Security](), [Incident response](), [Threat Hunting & Intel](), [Architecture & Design](), [Cloud](), [data](), [real-time](), [Amazon Web Services]() Tags: [agentic](), [architecture](), [aws](), [clickhouse](), [cloud](), [cost](), [data](), [incident-response](), [logs](), [real-time](), [scale](), [security](), [workflows]() ### AI overview iFood rebuilt its in-house security platform on ClickHouse Cloud to handle high-volume log ingestion, long-term retention, and rapid incident response. Compared with its earlier Databricks-based approach, the platform delivered 9-16x faster queries at 40-50% lower cost, near real-time data freshness, and agentic threat-hunting workflows that reduced work from about a week to roughly two hours. ### Source excerpt iFood rebuilt its in-house security platform on ClickHouse Cloud, getting 9-16x faster queries at 40-50% of the cost and unlocking agentic threat hunts that cut a week of analyst work down to two hours. ## DevOps Automation Platform Explained: Why You Need One DevFeed: [DevOps Automation Platform Explained: Why You Need One]() Original publisher: [Read original article]() Author: Eric Minick Published: 2026-08-11T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [DevOps](), [Automation](), [Deployment](), [Artificial Intelligence](), [ci](), [Provisioning](), [Terraform](), [Ansible](), [Incident response]() Tags: [ai](), [ansible](), [automation](), [ci](), [deployment](), [devops](), [incident](), [monitoring](), [provisioning](), [security](), [terraform]() ### AI overview This article explains how a DevOps automation platform connects build, test, deployment, security, provisioning, incident response, and rollback workflows. It contrasts an integrated, workflow-aware platform with separate automation tools such as Ansible, CI runners, and Terraform, and describes AI-native capabilities including test selection, failure diagnosis, anomaly detection, and auto-remediation. ### Source excerpt What is a DevOps automation platform and why does your team need one? How deployment automation, AI, and automated DevOps speed up delivery. | Blog ## Agentic Engineering 2.0 Explained: The Future of AI Engineering DevFeed: [Agentic Engineering 2.0 Explained: The Future of AI Engineering]() Original publisher: [Read original article]() Author: Zohar Einy Published: 2026-08-10T11:32:21Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [AI Engineering](), [Artificial Intelligence](), [Incident response](), [Graphs](), [Code review]() Tags: [agentic](), [agents](), [ai-agents](), [ai-engineering](), [autonomous](), [building](), [development](), [incident](), [incident-response](), [latency](), [scope](), [workflow]() ### AI overview The article distinguishes two generations of agentic engineering. Version 1.0 uses AI agents in deterministic workflows with predefined stages, prompts, responsibilities, and hand-offs. Version 2.0 gives an agent a goal and lets it determine the path, with the foundation built during the first generation enabling that transition. A self-healing incident workflow illustrates the contrast. ### Source excerpt Agentic engineering 1.0 wires the path; 2.0 hands agents a goal. See how the shift works and what foundation to build in 2026. ## Inside the Modern SOC: The Identity Front Door DevFeed: [Inside the Modern SOC: The Identity Front Door]() Original publisher: [Read original article]() Author: Sharon Maydar Published: 2026-08-07T23:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [Incident response](), [MFA](), [Vulnerabilities]() Tags: [ai](), [attacks](), [authentication](), [credential-theft](), [identity](), [incident-response](), [inside-the-modern-soc](), [insights](), [mfa](), [phishing](), [soc](), [social-engineering](), [unit-42-incident-response-report](), [vulnerabilities]() ### AI overview The article examines identity-based initial access, including credential theft, MFA manipulation, session hijacking, phishing, and social engineering. It describes how attackers expand access through persistence, privilege escalation, and lateral movement, challenging SOC teams to correlate signals across environments. ### Source excerpt Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond. The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42. ## Introducing Investigations, powered by Nexus. DevFeed: [Introducing Investigations, powered by Nexus.]() Original publisher: [Read original article]() Author: Pete Hamilton Published: 2026-08-05T13:48:00Z Content type: article Language: en Sources: [The incident.io Blog]() Topics: [incident](), [Incident response](), [Artificial Intelligence](), [telemetry]() Tags: [agentic](), [ai](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [logs](), [metrics](), [outage](), [post-mortem](), [reasoning](), [root-cause-analysis](), [slack-incident]() ### AI overview The article introduces Investigations, an incident.io feature powered by Nexus that autonomously investigates and diagnoses incidents alongside human responders. It analyzes context such as postmortems, logs, metrics, deployments, and dependencies, then provides hypotheses, evidence, next steps, and visible reasoning throughout incident resolution. ### Source excerpt Today we're launching Investigations: agentic root cause analysis that starts the moment you're paged, figures out what broke and why, and works with your team through to resolution. Here's what we built, what's powering it, and why it took some time to get right. ## Fact-checking PagerDuty's Opsgenie alternatives comparison table DevFeed: [Fact-checking PagerDuty's Opsgenie alternatives comparison table]() Original publisher: [Read original article]() Author: Tom Wentworth Published: 2026-07-28T14:21:14Z Content type: opinion Language: en Sources: [The incident.io Blog]() Topics: [incident](), [incident management](), [Incident response](), [Slack](), [Artificial Intelligence](), [dashboards](), [Microsoft Teams](), [API](), [Terraform](), [issue tracker]() Tags: [ai](), [api](), [article](), [comparison](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [microsoft-teams](), [outage](), [post-mortem](), [slack](), [slack-incident](), [terraform]() ### AI overview The article fact-checks PagerDuty's comparison table for Opsgenie alternatives, arguing that its description of incident.io is inaccurate. It presents incident.io as an end-to-end AI incident management platform with on-call scheduling, alert routing, incident response, dashboards, mobile access, status pages, investigation, post-mortems, insights, workflow automation, API access, and Terraform support. ### Source excerpt PagerDuty published a new comparison table about incident.io. Once again, it describes a product we don't recognize. So once again, we're correcting the record, row by row, with receipts. [Next page]()