Stamus Networks Blog

Clear NDR® U42.2: A New Analyst Experience and a More Powerful AI Investigation Layer

pmanev@stamus-networks.com (Peter Manev) — Tue, 19 May 2026 12:45:00 GMT

At Stamus Networks, we measure releases by how much they improve the day-to-day work of security analysts and threat hunters. By that measure, Clear NDR^® U42.2 is one of our most significant releases to date.

When the Perimeter Fails, the Network Tells the Truth

phil@stamus-networks.com (Phil Owens) — Thu, 09 Apr 2026 20:05:56 GMT

SentinelOne's "Edge Decay" research names the threat. Here's how network detection and response closes the visibility gap.

The SentinelOne team today published a compelling piece of threat research titled "Edge Decay: How a Failing Perimeter Is Fueling Modern Intrusions." It's a must-read for any security leader still placing primary trust in perimeter-based defenses. The research pulls no punches: the perimeter isn't failing – it has already failed. Firewalls, VPN concentrators, and legacy edge appliances have become some of the most actively targeted infrastructure in the modern enterprise.

We couldn't agree more. And we think the research points directly to a critical question the security industry needs to answer: once attackers are past the edge – or worse, inside the edge device itself – who is watching?

When EDR Goes Dark: Why Network Visibility is Your Last Line of Truth

pmanev@stamus-networks.com (Peter Manev) — Fri, 20 Mar 2026 13:22:47 GMT

I've spent a significant part of my career participating in NATO cyber defense exercises - large-scale, red team/blue team operations designed to stress-test the real-world resilience of enterprise security stacks across allied nations. These are serious exercises, with serious adversary simulations. And one pattern repeats itself with remarkable consistency across nearly every engagement I've been part of: the red team neutralizes EDR early.

Suricata Language Server 2.0: Major Update with Workspace Intelligence

eleblond@stamus-networks.com (Eric Leblond) — Thu, 19 Mar 2026 07:30:00 GMT

We're excited to announce version 2.0 of the Suricata Language Server, featuring workspace-wide analysis, intelligent conflict detection, and a complete architectural modernization. This release brings powerful new capabilities for managing large Suricata ruleset deployments.

Why 'Digital Frontline' Analysis Validates Our 10-Year NATO Exercise Commitment

pmanev@stamus-networks.com (Peter Manev) — Tue, 17 Feb 2026 13:46:22 GMT

An analysis by political analyst Tarık Özcan published this week in Meer captures something those of us working in European cyber defense have been living with for years: "NATO today is facing threats of a scale and complexity it has not dealt with before."

Detecting Attacks against CVE-2026-21510 and CVE-2026-21511 using Clear NDR

Stamus Networks Team — Wed, 11 Feb 2026 22:04:14 GMT

This blog describes the steps Stamus Networks customers may take to determine if any of your systems have been attacked in the past, are currently under attack or vulnerable as a result of two recent Microsoft vulnerabilities outlined in CVE-2026-21511 and CVE-2026-21510. This blog was originally published as a Stamus NetworksTechnical Brief, StamusNetworks-TB-MS-CVE-022026-1(PDF).

Breaking Free: How MCP and Open Standards End the Vendor Lock-In Cycle in Network Security

Clément Genetet — Tue, 10 Feb 2026 13:30:01 GMT

The cybersecurity industry has a dirty secret: vendor lock-in isn't a bug, it's a feature. For years, network security vendors have designed their platforms to trap your data, your integrations, and ultimately your budget in proprietary ecosystems that become more expensive and difficult to escape over time.

Beyond the Chatbot: Meet Your New Autonomous Tier-3 Threat Hunter

phil@stamus-networks.com (Phil Owens) — Tue, 13 Jan 2026 09:00:00 GMT

If you’ve been following our recent work at Stamus Networks, you’ve likely seen my demonstrations on integrating Large Language Models (LLMs) with Clear NDR via our Model Context Protocol (MCP) server. Until now, those sessions were mostly interactive—a "human-in-the-loop" conversation where the analyst asks a question and the AI provides an answer.

But here, I want to show you something that shifts the paradigm entirely.

The Future of Threat Detection & Response: Automation, AI, and the Shift Toward Proactive Security

mark@stamus-networks.com (D. Mark Durrett) — Tue, 06 Jan 2026 15:00:02 GMT

Security teams aren’t just reacting to threats anymore, they’re working to stay ahead of them. The 2025 SANS Detection & Response Survey makes it clear that organizations are accelerating their adoption of automation, AI, and proactive detection and response techniques in an effort to reduce analyst workload and improve response times.

But while automation and AI adoption are rising, confidence, maturity, and operational readiness still vary widely. Here’s what the data from the report reveals about where the industry is headed and what security teams need to do to prepare.

Doing More With Less: What the 2025 SANS Detection & Response Survey Says About Budget Pressure

mark@stamus-networks.com (D. Mark Durrett) — Tue, 30 Dec 2025 13:00:01 GMT

Budgets may not be shrinking, but they certainly aren’t keeping up with the complexity and scale of today’s threat landscape. According to the 2025 SANS Detection & Response Survey, most security teams are being asked to expand their capabilities without receiving the resources they need to match rising expectations.

This mismatch between demands and funding is pushing organizations to rethink how they allocate time, tools, and investment. Here are the key budget-related insights from the SANS report and what they mean for detection and response programs in 2026.