Abstract

Paying a tremendous tariff on security data storage? 80% of security data collected is never used for detection, investigation, or response. This isn't a tooling failure. It's a data strategy failure. Treating all data the same is what drives runaway costs and architectural rigidity. Composable SIEM enables tiered and federated retention strategies, keeping high-value data close to detection engines while placing lower-value or regulatory data into cost-efficient storage that remains accessible when needed. The goal is simple: right data, right tier, right cost. Learn more 👉 https://lnkd.in/gAMPJuxR

AI can triage threats, cluster indicators, and scan data without fatigue. So what can't it do? Decide which battles are worth fighting. Simone Petrella's C2 Corner makes the case for AI as the tactician and humans as the strategists, and what it takes to be the strategist: → Why AI wins at speed, scale, and repeatable plays → Why generalists thrive when the rules keep shifting Plus how the Abstract Intel Gallery puts intel to work in the pipeline. A year later, the argument holds up. Worth the revisit 👉https://lnkd.in/g26cMr9j

Collection is no longer just log ingestion. It's the control plane where data is shaped before it becomes expensive, rigid, or locked into a single system. Abstract's security data fabric lets you normalize, enrich, filter, mask, and route data before it reaches its destination. Filtering can happen in the pipeline or at the source. The result: less noise to your detection tools, lower storage spend, no lost coverage. See the full breakdown 👉 https://lnkd.in/g56EYhTV

Three NetScaler CVEs are now confirmed exploited, and a fourth critical one landed Friday. CVE-2026-107406 is a 9.5 that hits SAML boxes already patched for the first three. The first lesson hasn't changed: implants survive the patch. Webshells, modified Apache configs, cron entries, setuid shells. Inside the guide: → Log signatures for the exploited CVEs → How to hunt implants → What to rotate, and why to rebuild instead of clean Hunt first, then patch. Read the full guide: https://lnkd.in/guN_D2Ph

AI-SOC isn't a new category. It's a capability. A decade ago, SOAR launched as a standalone category. SIEM vendors were forced to absorb it: every major SIEM acquired a SOAR company or rebuilt the capability in-house. AI-SOC will follow the same path. AI-SOC is AI built into the security work teams already do, like detection, investigation, and response. Not a separate product standing apart from the SIEM. AI doesn't replace SIEM. It augments it. Read more in the Composable SIEM Manifesto: https://lnkd.in/gYGJReT4

Our COO & Co-Founder, Chris Camacho has been named a 2026 Northern Virginia Technology Council (NVTC) Cyber50 honoree! The Cyber50 recognizes the executives and companies actually moving cybersecurity forward across the region. Congrats Chris and to all of this year's honorees! Full list: https://lnkd.in/gTWE36-J

Abstract is in Toronto for SecTor 2026 🇨🇦 We’re here catching up with people from across the security community. If you’re attending, make sure to connect with the team!

Where does in-stream detection actually fit in the SecOps picture? There’s more nuance to that question than simply choosing between the pipeline and the SIEM. Colby DeRodeff breaks down where different detection methods fit, why placement matters, and how they can work together as part of a composable approach to SecOps. For the full breakdown, read Colby’s take here: https://lnkd.in/gQ9bG5qx

Health-ISAC has a firsthand view into the challenges security teams face across the healthcare sector. When they evaluated a SIEM for their own internal operations, they were looking for more control over their data and detections, flexibility to work with existing tools, and an approach that could adapt without forcing a major rip-and-replace. That’s what led them to Abstract. Read more about why Health-ISAC selected Abstract and what that looks like in practice: https://lnkd.in/gGUCmp4Q