Cybersecurity guides for businesses.
Clear answers to the questions we hear most: how a SOC works, how EDR, XDR and MDR differ, how threats are hunted and what to do when something goes wrong.
If you are under attack
- CEO fraud and BEC: how to spot them and what to do if your company has already sent the moneyCEO fraud and BEC are email scams in which someone impersonates an executive or a supplier so your company pays into an account they control. If you've already sent the transfer, call your bank now so it can try to hold the funds, report it to the police and check for a compromised mailbox.6 min read
- Compromised Microsoft 365 or Google Workspace account: how to take back controlIf a business account is compromised, block sign-in, revoke all its sessions and change the password from a clean device. Then remove what the attacker may have left to get back in: new MFA methods, forwarding rules, OAuth apps with permissions and app passwords. Finally, review what they read, sent or downloaded.6 min read
- Data breach at your company: how to confirm it, contain it and measure its scopeIf you suspect a data breach, first confirm whether it is real and which system the data came from. Then cut off the exit path without destroying evidence, establish what information was exposed, whose it is and since when, coordinate communications with your legal counsel, and watch for the data resurfacing on forums, marketplaces or leak sites.6 min read
- An employee fell for a phishing email: what your company should do, depending on what happenedIf an employee fell for phishing, act based on what they did. If they only clicked, check the device and block the domain. If they typed their password, change it from a clean device, end their sessions and review MFA and mailbox rules. If they opened an attachment, isolate the device. Then search other mailboxes for the same email.7 min read
- Ransomware attack on your company: what to do in the first hours and how to recoverIf ransomware has encrypted your company's computers, disconnect the affected systems from the network without shutting them down, keep the ransom note and the logs, coordinate the response over a channel outside corporate email, and don't pay or negotiate on your own. Restore from verified backups only once you know how the attacker got in.8 min read
Understanding cybersecurity
- In-house vs outsourced SOC: which is right for your company?An in-house SOC gives you maximum control and business knowledge, but it requires budget, tools and about five people for every seat you want to staff 24/7. An outsourced SOC (SOC as a service or MDR) provides continuous monitoring and response with less internal structure. Many companies end up combining both in a hybrid model.7 min read
- Leaked corporate credentials: how to tell if your company's are on the dark web or in infostealer logsLeaked corporate credentials are your company's usernames, passwords and session cookies circulating in third-party breaches, combolists or infostealer logs. To find out if yours are, search for your domains in breach alert services and in intelligence that covers infostealer logs. If they show up, change passwords, revoke sessions and clean the infected machine.7 min read
- EDR vs XDR vs MDR: the differences (and where SIEM and MSSP fit)EDR and XDR are tools: EDR detects and responds on endpoints, and XDR also correlates email, identity, network and cloud. MDR is a service: an external team uses those tools to monitor and respond 24/7. A SIEM centralizes logs from any source, and an MSSP manages your security with a broader scope.7 min read
- What is MITRE ATT&CK? Tactics, techniques and how to use it for detection and threat huntingMITRE ATT&CK is a free, open knowledge base that describes how attackers operate, based on attacks observed in the real world. It organizes their behavior into tactics (the why), techniques and sub-techniques (the how), and procedures. It is used to design detections, guide threat hunting and measure the coverage of your defenses.7 min read
- MTTD, MTTA, MTTC and MTTR in cybersecurity: what they are, how to calculate them and how to reduce themMTTD (mean time to detect), MTTA (to acknowledge), MTTC (to contain) and MTTR (to respond or resolve) measure how long a security team takes in each phase of an incident. Each is calculated as the average of the time differences between two points in the incident. If you do not define those points clearly, the figures are not comparable.7 min read
- Types of threat intelligence: strategic, operational, tactical and technicalThreat intelligence is divided into four types based on who uses it and for what: strategic (leadership and risk), operational (specific attacks being prepared against you), tactical (how attackers operate) and technical (indicators such as IPs, domains or hashes). Each type has its own audience, shelf life and sources.6 min read
- What is a SOC (security operations center) and how does it work?A SOC (security operations center) is the team, processes and technology that monitor an organization's activity to detect attacks, investigate them and respond before they cause damage. It works on telemetry from endpoints, network, email, identity and cloud, usually with a SIEM, an EDR and a SOAR.7 min read
- What is an agentic SOC and how do AI agents work with analysts?An agentic SOC is a security operations center in which AI agents handle alert triage, enrichment and prioritization and propose the response, while analysts validate the decisions with impact. Unlike SOAR, which follows fixed playbooks, the agents plan each investigation based on what they find.7 min read
- What is an infostealer? What it steals, how it infects and how to detect it in your companyAn infostealer is malware designed to steal, within seconds, the data stored on a computer: browser passwords, session cookies, access tokens, cryptocurrency wallets and system information. It packages everything into a file, called a log, which the attacker uses or sells. It is one of the most common entry points in attacks against companies.8 min read
- What is an IOC (indicator of compromise) and how to use it effectivelyAn IOC, or indicator of compromise, is an observable piece of technical data, such as a file hash, an IP address, a domain or a registry key, that indicates a system may be compromised or under attack. It helps you detect and hunt for known threats, but it ages quickly: attackers can change many of these indicators with little effort.7 min read
- What is CTEM (Continuous Threat Exposure Management)? The 5 stages and how to get startedCTEM (Continuous Threat Exposure Management) is a program Gartner proposed in 2022 to continuously reduce what an attacker could exploit in your company. It runs in cycles of five stages: scoping, discovery, prioritization, validation and mobilization. It describes a way of working that combines several tools.6 min read
Integrations by category
- Cloud integration: AWS, Microsoft Azure and Google CloudIntegrating AWS, Microsoft Azure and Google Cloud with the SOC means collecting their activity logs and the findings from their security services (GuardDuty, Defender for Cloud, Security Command Center) to detect stolen credentials, exposed resources and infrastructure abuse. The usual response, depending on the provider, is to disable credentials, isolate instances and close public access.5 min read
- EDR and XDR integration: CrowdStrike, SentinelOne, Microsoft Defender, Cortex XDR and moreConnecting your EDR or XDR to Ciberia MDR means every alert it raises is investigated around the clock. AI agents cross-reference its telemetry with email, identity, network and cloud in seconds, an analyst validates decisions with impact, and containment uses the tool's own actions, such as isolating the device, killing a process or quarantining a file. Your EDR stays in place.6 min read
- Email security integration: Microsoft 365, Gmail, Proofpoint, Mimecast and moreIntegrating email security with the SOC helps catch what the filter let through or could not judge: spoofing, BEC fraud with no attachments, and links that turn malicious after delivery. The usual response, depending on the tool, is to pull the message from every mailbox, block the sender and check who clicked.5 min read
- Firewall and network integration: Palo Alto Networks, Fortinet, Cisco, Zscaler, Darktrace and moreIntegrating your firewall, proxy, DNS and NDR with the SOC adds what agents can't see: traffic from devices without EDR, connections to command-and-control servers, lateral movement and unusual data outflows. The usual response, depending on the tool, is to block an IP address, a domain or a URL for the entire organization.5 min read
- Identity integration: Okta, Microsoft Entra ID, Active Directory and GoogleIntegrating your identity provider (Okta, Microsoft Entra ID, Active Directory or Google) with the SOC lets you detect anomalous sign-ins, MFA abuse and privilege escalation that never trigger an alert on the endpoint. The usual response, depending on the tool, is to revoke sessions, force a password change and block the account while you investigate.5 min read
- SIEM integration: Splunk, Microsoft Sentinel, IBM QRadar, Elastic, Google SecOps and moreIntegrating your SIEM with Ciberia means its alerts and events, whether in Splunk, Microsoft Sentinel, IBM QRadar, Elastic or Google SecOps, are reviewed 24/7 and correlated with endpoint, identity, email and cloud telemetry. Ciberia works on top of your SIEM without replacing it: you keep your rules, your retention and your dashboards.4 min read
- Threat intelligence feed and platform integration: VirusTotal, Recorded Future, MISP, KELA and moreIntegrating threat intelligence feeds and platforms such as VirusTotal, Recorded Future, MISP, KELA, SpyCloud or Intel 471 provides the external context your tools lack: whether an IP, domain or hash is malicious, which campaign or actor it belongs to, and whether your credentials are circulating. Ciberia combines it with its own intelligence from Ciberia Intel.5 min read
- Ticketing and collaboration integration: Jira, ServiceNow, BMC, Slack and Microsoft TeamsIntegrating the SOC with your ticketing (Jira, ServiceNow, BMC) and chat (Slack, Microsoft Teams) tools gets every finding to the people who need to act, with the context they need and without copying data by hand. Playbooks open the ticket, alert the team, request approval when needed and close the loop when the task is done.5 min read
Let's talk about your security.
We show you the platform with your technology in mind and look at what we can automate from day one.