14:02:11 · suspicious encoded PowerShell · endpoint WKS-011414:02:12 · impossible travel sign-in · user m.keller14:02:12 · beaconing to rare domain · fw-eu-0314:02:13 · new local admin created · srv-ad-0214:02:14 · mass file rename detected · share \\files\finance14:02:15 · TOR exit node connection · 10.4.12.8714:02:15 · disabled EDR sensor · endpoint LAP-220914:02:16 · anomalous volume of DNS TXT queries · dns-0114:02:17 · credential stuffing pattern · vpn-gw-0114:02:18 · scheduled task from temp directory · WKS-087114:02:19 · outbound SMB to external host · 172.16.9.4414:02:20 · suspicious OAuth consent granted · tenant eu-west14:02:21 · LSASS memory access · srv-file-0714:02:22 · rare parent-child process chain · WKS-150214:02:11 · suspicious encoded PowerShell · endpoint WKS-011414:02:12 · impossible travel sign-in · user m.keller14:02:12 · beaconing to rare domain · fw-eu-0314:02:13 · new local admin created · srv-ad-0214:02:14 · mass file rename detected · share \\files\finance14:02:15 · TOR exit node connection · 10.4.12.8714:02:15 · disabled EDR sensor · endpoint LAP-220914:02:16 · anomalous volume of DNS TXT queries · dns-0114:02:17 · credential stuffing pattern · vpn-gw-0114:02:18 · scheduled task from temp directory · WKS-087114:02:19 · outbound SMB to external host · 172.16.9.4414:02:20 · suspicious OAuth consent granted · tenant eu-west14:02:21 · LSASS memory access · srv-file-0714:02:22 · rare parent-child process chain · WKS-1502

14:02:11 · suspicious encoded PowerShell · endpoint WKS-011414:02:12 · impossible travel sign-in · user m.keller14:02:12 · beaconing to rare domain · fw-eu-0314:02:13 · new local admin created · srv-ad-0214:02:14 · mass file rename detected · share \\files\finance14:02:15 · TOR exit node connection · 10.4.12.8714:02:15 · disabled EDR sensor · endpoint LAP-220914:02:16 · anomalous volume of DNS TXT queries · dns-0114:02:17 · credential stuffing pattern · vpn-gw-0114:02:18 · scheduled task from temp directory · WKS-087114:02:19 · outbound SMB to external host · 172.16.9.4414:02:20 · suspicious OAuth consent granted · tenant eu-west14:02:21 · LSASS memory access · srv-file-0714:02:22 · rare parent-child process chain · WKS-150214:02:11 · suspicious encoded PowerShell · endpoint WKS-011414:02:12 · impossible travel sign-in · user m.keller14:02:12 · beaconing to rare domain · fw-eu-0314:02:13 · new local admin created · srv-ad-0214:02:14 · mass file rename detected · share \\files\finance14:02:15 · TOR exit node connection · 10.4.12.8714:02:15 · disabled EDR sensor · endpoint LAP-220914:02:16 · anomalous volume of DNS TXT queries · dns-0114:02:17 · credential stuffing pattern · vpn-gw-0114:02:18 · scheduled task from temp directory · WKS-087114:02:19 · outbound SMB to external host · 172.16.9.4414:02:20 · suspicious OAuth consent granted · tenant eu-west14:02:21 · LSASS memory access · srv-file-0714:02:22 · rare parent-child process chain · WKS-1502

14:02:11 · suspicious encoded PowerShell · endpoint WKS-011414:02:12 · impossible travel sign-in · user m.keller14:02:12 · beaconing to rare domain · fw-eu-0314:02:13 · new local admin created · srv-ad-0214:02:14 · mass file rename detected · share \\files\finance14:02:15 · TOR exit node connection · 10.4.12.8714:02:15 · disabled EDR sensor · endpoint LAP-220914:02:16 · anomalous volume of DNS TXT queries · dns-0114:02:17 · credential stuffing pattern · vpn-gw-0114:02:18 · scheduled task from temp directory · WKS-087114:02:19 · outbound SMB to external host · 172.16.9.4414:02:20 · suspicious OAuth consent granted · tenant eu-west14:02:21 · LSASS memory access · srv-file-0714:02:22 · rare parent-child process chain · WKS-150214:02:11 · suspicious encoded PowerShell · endpoint WKS-011414:02:12 · impossible travel sign-in · user m.keller14:02:12 · beaconing to rare domain · fw-eu-0314:02:13 · new local admin created · srv-ad-0214:02:14 · mass file rename detected · share \\files\finance14:02:15 · TOR exit node connection · 10.4.12.8714:02:15 · disabled EDR sensor · endpoint LAP-220914:02:16 · anomalous volume of DNS TXT queries · dns-0114:02:17 · credential stuffing pattern · vpn-gw-0114:02:18 · scheduled task from temp directory · WKS-087114:02:19 · outbound SMB to external host · 172.16.9.4414:02:20 · suspicious OAuth consent granted · tenant eu-west14:02:21 · LSASS memory access · srv-file-0714:02:22 · rare parent-child process chain · WKS-1502

Community survey · 2027

Tell us how AI should work in cybersecurity

For CISOs, cyber leaders, and SOC professionals

AI is changing how security teams handle alerts, investigate threats, and respond to incidents. This survey looks at how your team works today, where AI already fits, and how much autonomy you expect it to have by 2027.

What you'll get

Your personalized SOC profile, based on your answers
A view of how your responses compare with the community
The full report in your inbox, if you choose to receive it

15 questionsAbout 4 minutesAnonymous

We'll start with alert volume and how your team handles alerts.

By continuing, you agree to Sekoia's privacy policy. Your survey responses are anonymous.