Endpoint, Internet-Edge, OT & Incident Response

Reporting describes ransomware groups exploiting a Palo Alto Networks GlobalProtect authentication bypass, with potential movement to credential theft, lateral movement, and vCenter/ESXi attacks; BeyondTrust reporting describes targeted access, credential-theft attempts, and log deletion. New Cortex XDR One and SentinelOne–Cisco–Splunk integration announcements are vendor claims whose efficacy and operational tradeoffs need validation. Patch, investigate downstream activity, preserve off-box evidence, and test recovery; OT environments also need scrutiny for inherited trust paths.