Experienced a breach?
Contact us
Experienced a breach?
CONTACT US
Resource Type
Blog
Threat Reports and Advisories
Guides and tools
Datasheet
Webinars
Topics
Cloud
Incident Response
OT Security
Malware
Vulnerabilities
Attack Techniques
Detection
State Actors
Research
Forensics
Email
Cyber Crime
Ransomware
Mitigation and Response
Managed Detection and Response
Tabletop War Games
Threat Intelligence
Security Mitigation
VMware Security
Artificial intelligence (AI)
Threat Research
Blog Incident Response Ransomware
Investigating Data Extortion Involving Trusted Vendor Access
Learn how sensitive data left an organization through legitimate vendor access, and what the investigation revealed about logging and evidence preservation.
Asaf Saada
1.11.2026
6 min
Blog Incident Response Ransomware
Incident Response Best Practices: Strategies, Tools & Plans
Build incident response best practices into your plan, team, tools, and exercises, using NIST SP 800-61 Rev. 3 and lessons from real investigations.
Rena Stern
28.10.2026
14 min
Blog Incident Response Ransomware
When IT Support Is the Attack: How Law Firms Can Defend Against Silent Ransom Group
Strengthen your readiness against Silent Ransom Group. As SRG increasingly uses IT impersonation and legitimate remote-access tools to target law firms, firms should review how they verify support interactions, protect sensitive client data and detect suspicious activity.
Rena Stern, Karin Lagziel
22.09.2026
13 min
Blog Cloud
Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know
Learn how Shai-Hulud compromises trusted software workflows, exposes credentials across CI/CD environments, and creates attack paths into cloud, production, and downstream systems, and how security teams can contain and recover from the compromise.
Omer Kidron, Lahav Meir
6.09.2026
10 min
Blog Cloud
Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data
Expose how ransomware operators abuse trusted cloud services like OneDrive to bypass traditional security controls, exfiltrate sensitive data over legitimate HTTPS traffic, and hide malicious activity within normal business operations.
Rena Stern
31.08.2026
11 min
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
First reported in 2025, Fire Ant remained active into 2026. Explore how the threat actor expanded beyond hypervisors into trusted infrastructure, compromising routers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments.
Sygnia Team
27.08.2026
35 min
Blog OT Security
Incident Response vs. Crisis Management: Why Treating Them as the Same Thing Is Dangerous
Incident response contains the attack. Crisis management protects the business. Learn why conflating the two is dangerous and how to align them.
Rena Stern
12.08.2026
15 min
Blog Artificial intelligence (AI) Incident Response
Code at AI Speed, Risk at AI Scale
AI-generated code is transforming software development, but it is also introducing new security risks. Learn how a real-world penetration test uncovered a critical authentication flaw that exposed sensitive customer data and what security teams can do to prevent similar issues.
Zach Mead
28.07.2026
11 min
Blog OT Security
Why Most OT Cyber Incidents Never Reach the OT Environment
Learn why modern industrial operations depend on IT, the misconceptions that leave organizations exposed, and how anti-fragile resilience keeps production running when IT is compromised.
Tamir Margalit
26.07.2026
6 min
Blog Threat Intelligence Threat Research
When Technical Controls Work, Attackers Change the Rules: How a Failed Intrusion Became a Data Exposure Incident
Discover how a failed intrusion quickly became a data exposure incident after a threat actor pivoted from blocked technical attacks to social engineering, and why layered defenses, rapid response, and operational safeguards are essential when attackers change the rules.
Karin Lagziel
12.07.2026
6 min
Blog Ransomware Threat Intelligence Threat Research
Ransomware Incident Response in 2026: What Has Changed and What CISOs Are Still Getting Wrong
Learn what has changed in ransomware incident response in 2026, and what CISOs are still getting wrong
Rena Stern
12.07.2026
19 min
Blog Threat Intelligence Threat Research
Inside an AI-Assisted Cloud Attack: Familiar Techniques at Unfamiliar Speed
Learn how a threat actor used AI to accelerate a cloud attack from initial access to broad compromise in just 72 hours
Sergey Kozyrev, Eldar Goren, Arsela Rama, Liad Minster, Asaf Saada
29.06.2026
21 min
Solutions
Blog Threat Intelligence Threat Research
Why 73% of Organizations Still Aren’t Ready for a Cyberattack
Explore lessons from Sygnia's 2026 CISO Survey on Incident Response Readiness.
Rena Stern
28.06.2026
7 min
Blog Threat Intelligence Threat Research
Crypto Security in 2026: Why Transaction Authority Is the Most Important Security Control
Most crypto breaches occur when attackers reach transaction authority. Learn how to secure identities, infrastructure, and authorization systems.
Rena Stern
18.06.2026
7 min
Blog Attack Techniques Cyber Crime Detection Ransomware
Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected
Discover the detailed forensic investigation by Sygnia into the sophisticated cyber attack by Velvet Ant on a major organization.
Chen Tiktin
8.06.2026
21 min
Blog Threat Intelligence Threat Research
Incident Response Metrics That Actually Matter to Boards (And the Ones That Don’t)
Learn which incident response metrics boards actually need to make decisions, and which ones create false confidence.
Rena Stern
27.05.2026
16 min
Blog Threat Intelligence Threat Research
8 Incident Response Plan Mistakes That Lead to Failures
Learn the 8 critical incident response mistakes that leave 73% of organizations unprepared, and how to close the execution gaps that turn manageable cyber incidents into full-scale business crises.
Rena Stern
12.05.2026
14 min
Blog Mitigation and Response
Cyber Risk and Private Equity: How Threat Intelligence Protects Large Investment Portfolios
Explore how leading PE firms are shifting from reactive cyber incident response to continuous portfolio-wide risk visibility, using threat intelligence to protect enterprise value, reduce deal friction, and prevent a single breach from cascading across the entire portfolio.
Kobi Shetret, Shai Goel
12.05.2026
9 min
subsctibe decor
Want to get in touch?
Contact us