Build resilient defenses with the threats, etc quarterly report
When trusted access becomes untrustworthy
Attackers are increasingly using approved IT tools and AI assistants to slip past enterprise security controls. Because these tools are already trusted, malicious actions rarely trigger standard alarms.
Drawn directly from confirmed customer intrusions and first-party research between April and September 2026, Elastic's November 2026 threats, etc report, written by Elastic Threat Command, breaks down how adversaries exploit this access and how defenders can spot it.
Download the reportHighlights
- Abuse of trusted software: Attackers ran complete intrusions directly inside signed AI assistants and IT management tools. Defense requires evaluating actual behavioral outcomes instead of relying on binary allowlists.
- Identity beyond MFA: Adversaries bypassed MFA using phishing proxies and legacy authentication, breaching cloud accounts in under eight minutes. Defense requires continuous session monitoring rather than trusting login events.
- Machine speed in memory: We tracked automated exploits running in memory within seconds without touching the disk. Catching them requires monitoring low-level system activity and filtering noise directly in the data pipeline.
Additional resources
