Executive Protection Agent - Fog

Tanium relaunches security platform to counter AI attacks. Wed, 7th Oct 2026 (Yesterday) Tanium has relaunched its Security Operations platform to address attacks that use stolen credentials and standard administrative tools rather than malware. The updated product combines detection, response and threat hunting in a single workflow built on endpoint data already used by IT teams. It is designed to work alongside existing security information and event management and endpoint detection and response products, not replace them. The relaunch reflects a wider shift in cybersecurity as attackers rely less on malicious files and more on legitimate tools already present on corporate machines. That can make intrusions harder to spot because the activity may resemble routine work by internal administrators. One new element, Endpoint Drift, is intended to identify devices behaving outside their normal pattern. Another, Insights Engine, is designed to detect attackers operating inside trusted processes, replacing Tanium's previous process injection detection approach. Response functions have also been expanded so security teams can take action across large numbers of devices. Those actions include stopping a process, gathering forensic evidence and isolating a host on individual machines or across a wider estate. Tanium has also introduced what it calls a Federated SOC model. Under that setup, separate security teams can use the same platform while maintaining different suppression rules and automated response settings for their own environments. Another part of the relaunch focuses on threat hunting, an area often limited to experienced analysts because of the time and skill involved. Tanium said its Atlas tool allows analysts to ask questions in plain language, receive answers from endpoints in seconds and take follow-up action from the same interface. Atlas also prioritises alerts and suggests whether each should be dismissed, escalated, investigated through a hunt or contained. Tanium has added security operations dashboards and templates intended to give teams a starting point for these workflows. Harman Kaur, Chief Technology Officer, Tanium, said the changes were a response to the way artificial intelligence is reshaping attacker behaviour. "AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators," Kaur said. She added: "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once. That is what security operations has to become in the AI era." Market shift Tanium argues that many established security tools were built to identify known malicious files or signatures, while newer attacks may begin with a valid login and spread using built-in administration tools. In response, vendors are placing more emphasis on behaviour-based detection and rapid response tied to live endpoint telemetry. That shift has also driven greater interest in automation inside security operations centres, particularly as teams face large alert volumes and pressure to respond more quickly. Tanium is positioning its updated platform around that demand while stressing that automated actions remain governed by user-defined rules. External analysts broadly share the view that the operational tempo of attacks has increased. Dave Gruber, Chief Analyst, Omdia, said, "The AI-fueled threat landscape has changed the dynamics of security operations." He continued: "Speed is more important than ever before, as attack execution speeds out pace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures." Services link Alongside the platform update, Tanium is also highlighting HuntIQ, a service that pairs its threat hunters with customer environments. The company said those specialists use the same platform and artificial intelligence tools to search for threats, improve detections and support incident response. Tanium said lessons from that work are fed back into the product, including hunts created before a patch or common vulnerability and exposure reference is available. It cited its response to the FalconFlank zero-day as an example of that model. The relaunch underlines how endpoint-focused vendors are trying to move beyond device management and traditional detection by tying together visibility, investigation and remediation. For security teams, the key test will be whether those integrated workflows reduce response times without adding to the operational burden of already crowded toolsets. The updated Security Operations offering is available now.

Tanium unveils New SecOps capabilities. Tanium expands SecOps with real-time endpoint intelligence, AI-native hunting and agentic response to detect, investigate and contain threats faster. Oct 6, 2026 Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More Tanium has announced new security operations capabilities that give IT and security operators greater detection depth, response options, and AI-native hunting to investigate, contain, and resolve threats faster within live endpoint intelligence. The Tanium Security Operations capabilities are powered by Tanium Atlas, the company's autonomous operating system that allows customers to build a self-driving SOC that runs autonomously within the guardrails an operator sets. Tanium expands SIEM and EDR with live endpoint data. Tanium Security Operations enables IT and security operators to reason over the endpoint as it currently exists, extend existing SIEM and EDR investments, and act from a single platform. The portfolio of capabilities combines real-time visibility across managed endpoints and the ability to act safely at speed and scale. It features three pillars: * Detection depth and data fidelity: Threat detection against live endpoint state, not aged data. New Endpoint Drift surfaces abnormal behavior relative to historical baselines, and the Insights Engine detects advanced in-memory techniques, delivering faster, more focused hunting and better prioritization of suspicious activity across the fleet, with faster protection delivery. * Diverse response: Tanium pairs detection with a full spectrum of response options executed directly on the endpoint, from quarantining hosts to collecting forensic evidence. A new Federated SOC architecture lets operators work independently on a single platform, backed by a modernized Windows quarantine designed for agentic SOC actions and safer multi-team operations. * AI-native hunting: Tanium Atlas helps IT and security operators investigate threats, prioritize alerts, and determine next steps. With New Alert Prioritization and Triage, the queue is ranked to recommend whether to dismiss, escalate, hunt, or contain, resulting in faster alert-to-decision time, less analyst fatigue, and fewer low-value alerts. New SecOps dashboards and templates make expert-level hunting faster to scale. "Security teams don't need another tool that generates more alerts. They need the truth about what's happening on their endpoints right now, and the power to act on it before an attacker does," said Harman Kaur, CTO, Tanium. "Tanium Atlas brings live endpoint intelligence and agentic AI together so operators can detect what is abnormal, investigate it in context, and respond immediately. The customer sets the rules and autonomy runs the workflow." Google Threat Intelligence adds investigation context. These new integrations deepen the context provided by live endpoint data. Google Threat Intelligence in Tanium SecOps brings premium intelligence directly into investigation and hunting workflows, while multi-provider reputation intelligence from five leading providers reduces false positives and accelerates triage. "The AI-fueled threat landscape has changed the dynamics of security operations," said Dave Gruber, chief analyst at Omdia. "Speed is more important than ever before, as attack execution speeds outpace current security operations mechanisms and processes." "Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures," Gruber added. HuntIQ combines threat hunters with agentic AI. Additionally, Tanium HuntIQ combines security research, expert threat hunters, and agentic AI built on Tanium Atlas for organizations that want to further minimize risk. Tanium HuntIQ experts work directly within customer environments to identify threats, strengthen detections, and support incident response. The findings are then fed back into the platform so that every subsequent hunt starts in a more intelligent place. What Tanium's SecOps expansion means for MSPs. For MSPs and MSSPs, the bigger opportunity is operational. Tanium is combining live endpoint telemetry, AI-assisted alert prioritization, threat hunting, and response into a single SecOps workflow, which could help providers reduce the manual effort of correlating alerts across multiple tools. The new capabilities include endpoint-level response actions and a Federated SOC architecture designed to support separate teams working from a shared platform. That fits a broader trend Channel Insider has been tracking around platform consolidation and agentic SecOps. As security providers look to expand managed detection and response and threat hunting without growing analyst headcount at the same rate, automation becomes more valuable when it is grounded in current endpoint data rather than in another layer of alerts. For Tanium partners, that could create room to build more advanced managed security services around Atlas and SecOps, although the announcement does not detail MSP-specific packaging, multi-tenancy, or partner economics. Jordan Smith is an enterprise technology and cybersecurity journalist with nearly a decade of experience covering B2B IT, federal technology, artificial intelligence, cybersecurity, cloud computing, and emerging digital trends. His reporting helps business and technology leaders understand how new technologies, security challenges, and infrastructure decisions affect modern organizations. Jordan has reported on enterprise and public-sector technology for TechnologyAdvice, HCLTech, MeriTalk, and Channel Insider. His background spans cybersecurity, cloud infrastructure, AI adoption, digital transformation, and federal IT initiatives, giving him a broad perspective on the tools, policies, and innovations shaping today's technology landscape. Before joining TechnologyAdvice, Jordan served as a Senior Technology Reporter at MeriTalk, where he covered the federal IT space, and later worked as a US Regional Reporter and Copy Editor/Writer for HCLTech. His experience across reporting, copyediting, podcasting, and event moderation allows him to translate complex technical topics into clear, timely, and useful insights for business audiences. Jordan holds a Master of Arts in Journalism from the University of Nebraska-Lincoln and a Bachelor of Science in Criminal Justice and Psychology from Edgewood University. Through his work, he helps readers stay informed about cybersecurity developments, enterprise technology trends, and the business impact of emerging IT solutions.

Critical vulnerabilities in Check Point, Kaspersky, and Tanium patch products. Post Views: 8 Check Point, Kaspersky, and Tanium have addressed critical flaws in their software solutions, including vulnerabilities that could enable remote code execution. Check Point vulnerabilities. Check Point's Security Management and Log Server systems were found to have a flaw designated CVE-2026-91843. This vulnerability allows an unauthenticated attacker to execute arbitrary code with elevated privileges during the login process. While no evidence of active exploitation has been confirmed, the vendor has released indicators of compromise to help identify potential breaches. Users without automatic update mechanisms are urged to apply patches immediately. CVE-2026-91843 details. This flaw enables an unauthenticated attacker to execute arbitrary code with elevated privileges during the login process. The vendor has provided indicators of compromise to assist in detecting potential breaches. Kaspersky vulnerabilities. Kaspersky issued a security advisory on September 17 highlighting a Redis-related vulnerability impacting Kaspersky Security 10 for Linux Mail Server. Discovered in 2023, the flaw could lead to system instability or arbitrary code execution when processing specific file formats. The vendor emphasized the potential for attackers to exploit this weakness to compromise affected systems. Redis-Related flaw. The Redis-related vulnerability (unspecified CVE) could allow attackers to cause system instability or execute arbitrary code when processing specific file formats. The flaw was discovered in 2023 but remains a critical risk for affected systems. Tanium security advisories. Tanium disclosed five security advisories this week, detailing high- and medium-severity issues across its product line. In Tanium Asset, two critical SQL injection vulnerabilities were resolved, which could have permitted authenticated attackers to access restricted data or manipulate database queries. A separate SQL query tampering flaw was also addressed in Threat Response. Additional updates included fixes for two medium-severity issues: a server-side request forgery vulnerability that could expose sensitive information and an improper access control flaw enabling unauthorized alert modifications. SQL injection and tampering issues. Tanium Asset resolved two critical SQL injection vulnerabilities, while Threat Response addressed a separate SQL query tampering flaw. These issues could have allowed authenticated attackers to access restricted data or manipulate database queries. Medium-Severity fixes. Tanium also resolved a server-side request forgery vulnerability and an improper access control flaw. The former could expose sensitive information, while the latter allowed unauthorized alert modifications. The disclosures follow a broader trend of threat actors targeting software supply chains and enterprise infrastructure. Cybersecurity professionals are advised to review patch management protocols and monitor for signs of exploitation linked to the identified vulnerabilities. Organizations are encouraged to implement proactive mitigation strategies to reduce exposure to these risks.