All Articles

Filter by Category

Indago Team 6/25/26 Indago Team 6/25/26

What the First LLM-Driven Intrusion Means for SOC Reporting Workflows

On May 10, 2026, Sysdig documented the first known intrusion in which an LLM agent drove every decision in the post-exploitation phase — from initial access to a fully exfiltrated internal database — in under sixty minutes. This post breaks down what actually happened, why it represents a genuine category shift in the threat landscape, and what it means for the SOC reporting workflows that were built for a slower kind of adversary.

Indago Team 5/28/26 Indago Team 5/28/26

Why Section-Level Regeneration Produces Better AI Reports

Most analysts have been there: one weak section in an otherwise solid report, and the temptation to hit regenerate and start fresh. The problem is that full regeneration treats every section as equally flawed — wiping out verified work to fix one paragraph. This post breaks down why section-level control produces better reports, how targeted instructions outperform global rewrites, and how matching the right AI model to the right section changes the quality of the final product.

Indago Team 5/21/26 Indago Team 5/21/26

What Happens When You Run Intelligence Reporting Through ChatGPT Instead of a Controlled Platform

General-purpose LLMs like ChatGPT are fast, accessible, and genuinely useful for early-stage research. They are also structurally unreliable for professional intelligence reporting — generating confident-sounding text that may have no grounding in a verifiable source, with no citation trail, no audit record, and no way to reproduce the output six months later when someone asks where it came from. This piece examines three dimensions where the two approaches diverge most sharply: hallucination risk, source attribution, and audit trail — and offers a clear framework for deciding which tool belongs where in a professional intelligence workflow.