Loading story…
Major security and observability vendors are accelerating the consolidation of the security data pipeline platform (SDPP) market through high-profile acquisitions, such as Palo Alto Networks acquiring Chronosphere for $3.3 billion and CrowdStrike acquiring Onum. These moves are reshaping the security operations center (SOC) landscape by making data pipelines the primary control plane, responsible for ingestion, normalization, enrichment, and routing of security telemetry. While these integrations promise improved data management and cost efficiency, they also raise concerns among practitioners about vendor neutrality and migration challenges as the market shifts toward fewer, more integrated solutions.
In parallel, organizations like InfluxData are moving away from reliance on third-party SaaS security tools after experiencing blind spots and delayed breach detection, as highlighted by their experience with the Codecov breach. By developing in-house platforms such as DiSCO, powered by time-series telemetry, they aim to achieve greater visibility and control over their security monitoring and supply chain observability. This trend underscores a broader industry movement toward both consolidation of commercial pipeline solutions and the adoption of custom telemetry-driven monitoring to address gaps left by traditional SaaS offerings.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several cybersecurity vendors and experts have announced new developments aimed at improving security operations centers (SOCs) and threat detection capabilities. ManageEngine has released a major upgrade to its Log360 SIEM platform, introducing a revamped threat detection engine with a central detection console, object-level filters, and over 1,500 updated detection rules to reduce alert noise and speed up response times. Arctic Wolf has expanded its Threat Intelligence Plus service, providing real-time, operationally proven indicators of compromise and enhanced integration with SIEM and threat intelligence tools for more effective threat hunting and incident response. Industry analysis highlights the convergence of SIEMs and data lakes, with modern platforms integrating advanced analytics, UEBA, and SOAR to address legacy challenges and support evolving SOC requirements. These developments reflect a broader trend toward automation, AI integration, and unified threat intelligence in security operations.
Jun 29, 2026
The cybersecurity landscape in 2025 saw significant evolution, with a marked increase in supply chain attacks targeting CI/CD pipelines, open source packages, and developer tooling. Organizations like StepSecurity reported detecting and responding to some of the most consequential supply chain compromises before they became public, highlighting the need for real-time visibility and enforcement across software supply chains. The year also witnessed rapid growth in the adoption of security solutions, as enterprises sought to protect their development environments and open-source repositories from increasingly sophisticated threats. Simultaneously, the industry experienced major shifts in technology and risk management. Startups drove innovation in browser security, application security for AI-generated code, and SOC automation, reflecting the growing importance of cloud-based workspaces and AI-driven applications. On the risk management front, CISOs faced a tightening cyber insurance market, with insurers demanding more rigorous proof of security controls and warning that major supply chain or AI-related incidents could quickly harden underwriting standards. These developments underscore the need for organizations to adapt their security strategies to address both emerging technical threats and evolving risk management requirements.
Jun 29, 2026
Security teams continue to face elevated risk from **network edge device vulnerabilities** and legacy/slow-to-patch infrastructure, with threat actors actively exploiting exposed perimeter systems and benefiting from limited vendor cooperation and uneven firmware update practices. Discussion also highlighted defensive approaches aimed at improving early warning and containment—particularly stronger monitoring/detection around edge assets and the use of deception mechanisms such as **canary tokens** to surface exploitation attempts sooner. Separately, security operations practitioners are emphasizing that many organizations are effectively **“flying blind”** due to incomplete or provider-controlled logging in cloud/SaaS environments, which can undermine detection engineering and incident response when platforms change telemetry or access patterns. The coverage also pointed to emerging efforts to benchmark **LLMs for defensive SecOps workflows** and shared practitioner perspectives on how large platforms (e.g., Reddit) approach threat detection, reinforcing that visibility and measurable detection capability are central constraints even when tooling and automation improve.
Jun 29, 2026