GitHub and npm introduced two key defenses: npm now places high‑impact accounts in read‑only mode for 72 hours after an email change or 2FA recovery, buying time to stop credential theft; GitHub Actions’ checkout action now defaults to blocking untrusted code from fork‑origin pull‑request triggers. The tweaks cut off early‑stage compromise vectors in supply‑chain attacks.
AWS’s GuardDuty Investigation Agent, now in public preview, auto‑correlates findings, 90‑day logs and resource topologies into risk‑rated, MITRE‑mapped reports. Accessible via console, CLI or API, it shrinks investigation time from hours to minutes, letting security teams focus on remediation instead of manual digging.
Elastic shows that fragmented SOC tool stacks cost analysts time and money, letting AI‑powered attackers finish a compromise in under a minute. It argues that only a unified, agentic platform that provides real‑time, cross‑telemetry access can let security teams use AI effectively and keep pace in 2026.