https://research.mysticcyber.com/Recent content in Research on Mystic Cyber ResearchHugoen-USFri, 07 Aug 2026 00:00:00 +0000https://research.mysticcyber.com/threat-hunts-shell-obfuscation-vmware-esx/Fri, 07 Aug 2026 00:00:00 +0000https://research.mysticcyber.com/threat-hunts-shell-obfuscation-vmware-esx/VMware ESX systems are a recurring target in ransomware campaigns. Threat groups including SCATTERED SPIDER, BlackBasta, Royal (aka BlackSuit) and Akira lean on the same handful of obfuscation tricks — here is how to hunt them.https://research.mysticcyber.com/expanding-ai-benchmarks-beyond-vulnerability-discovery/Thu, 06 Aug 2026 00:00:00 +0000https://research.mysticcyber.com/expanding-ai-benchmarks-beyond-vulnerability-discovery/The conversation about AI in cybersecurity has centered on capabilities like vulnerability discovery, exploit generation and automated proof-of-concept development. That framing leaves most of the defensive surface unmeasured.https://research.mysticcyber.com/secure-agent-harness-execution/Wed, 05 Aug 2026 00:00:00 +0000https://research.mysticcyber.com/secure-agent-harness-execution/As autonomous agentic systems take on more critical operations inside corporate boundaries, securing the execution harness against untrusted agent actions is the new frontier of enterprise risk mitigation.https://research.mysticcyber.com/what-a-board-wants-from-a-risk-report/Wed, 29 Jul 2026 00:00:00 +0000https://research.mysticcyber.com/what-a-board-wants-from-a-risk-report/Most quarterly risk reporting optimizes for completeness. Boards optimize for decisions. Three structural changes that close the gap without adding a reporting cycle.https://research.mysticcyber.com/response-playbooks-that-survive-contact/Wed, 22 Jul 2026 00:00:00 +0000https://research.mysticcyber.com/response-playbooks-that-survive-contact/We instrumented eighteen months of tier-one response across four mid-market SOCs. Automation cut volume, but only the playbooks with explicit rollback paths held up under real incidents.https://research.mysticcyber.com/pharma-segmenting-a-flat-network/Wed, 15 Jul 2026 00:00:00 +0000https://research.mysticcyber.com/pharma-segmenting-a-flat-network/A regulated manufacturer with a decade-old flat network needed segmentation before an audit. The phased path we ran, the two things that went wrong, and what it cost.https://research.mysticcyber.com/mcp-servers-new-trust-boundary/Wed, 08 Jul 2026 00:00:00 +0000https://research.mysticcyber.com/mcp-servers-new-trust-boundary/MCP servers sit between an assistant and your data with very little between them. Treat each one as an unauthenticated integration until proven otherwise.https://research.mysticcyber.com/detection-engineering-as-product-practice/Tue, 30 Jun 2026 00:00:00 +0000https://research.mysticcyber.com/detection-engineering-as-product-practice/Detections decay. Teams that version, test and deprecate them like software keep their true-positive rate flat as the estate grows; teams that do not, do not.https://research.mysticcyber.com/third-party-risk-when-vendors-ship-agents/Sun, 21 Jun 2026 00:00:00 +0000https://research.mysticcyber.com/third-party-risk-when-vendors-ship-agents/Vendor questionnaires assume software behaves the same way twice. Agentic vendors break that assumption — a revised diligence framework for procurement and security to run together.https://research.mysticcyber.com/higher-ed-visibility-unmanaged-devices/Fri, 12 Jun 2026 00:00:00 +0000https://research.mysticcyber.com/higher-ed-visibility-unmanaged-devices/A constant mix of student and faculty devices made the attack surface unknowable. Passive discovery plus enrollment nudges got coverage from an estimated 40% to 94% in one semester.