Blog
Stay ahead with news, opinion and research from the Swarm.
Swarm Intelligence: LiteLLM was the end of the chain, not the beginning.
LiteLLM's PyPI package was backdoored for under an hour on March 24. SSH keys, cloud credentials, and CI/CD secrets exfiltrated at install. Here is what is assessed to have happened.
Handala & MuddyWater: MDM Weaponization at Enterprise Scale
On 11 March 2026, an Iranian two-team operation destroyed 200,000 enterprise devices at Stryker without deploying a single piece of malware. One compromised Global Administrator account. One MDM console. Five hours. Swarm Brief 2602 maps the TTPs behind the Handala and MuddyWater operation and the scenario CovertSwarm would run against your environment.
Why Robbing Banks Is Easy (And Why That Should Terrify You)
A globally recognized ethical hacker shares real social engineering stories from legally robbing banks across five continents. The tools change. The human vulnerabilities don't.
Swarm Intelligence: Stryker’s Intune wipe proves your BCDR plan has a single point of failure
No malware. No ransomware. One compromised Global Admin account and the management console your IT team used this morning. The Stryker incident proves that when the management plane becomes the weapon, your BCDR plan may already have a single point of failure.
Dynamic Attack Surfaces: The Professional Sports Problem
Professional sports organizations face cybersecurity challenges that don't fit traditional frameworks. With seasonal spikes, constant third-party integrations, and workforce volatility, annual pen tests capture one snapshot while attackers exploit the gaps between assessments. Recent breaches prove why continuous offensive security is essential for dynamic environments.
Claude Jailbroken To Attack Mexican Government Agencies
A threat actor jailbroke Claude to orchestrate a month-long attack on Mexican government networks, stealing 150 GB of sensitive data. We analyze what really happened and what it means for AI-assisted cyber threats.
Jayson E Street Joins CovertSwarm
The man who accidentally robbed the wrong bank in Beirut is now part of the Swarm. Jayson E Street joins as Swarm Fellow to help us prove continuous offensive security is the only honest answer to how adversaries operate.
iNTERCEPT – How A Small RF Experiment Turned Into A Community SIGINT Platform
I’ve always been fascinated by RF. There’s something about the fact that it’s invisible, the fact that you might be able to hear aircraft passing overhead broadcasting their location, the fact that you might be able to pick out a…
When Your IDE Becomes An Insider: Testing Agentic Dev Tools Against Indirect Prompt Injection
Agentic development tools don't need to bypass your firewall. They're already inside. And if an attacker can control what they read, they can control what they do. We tested Google's Antigravity IDE against indirect prompt injection attacks.
What Moltbook reveals about AI agent security
The Moltbook launch exposed a critical gap: organizations deploying AI agents faster than they can secure them. Research shows 22% of enterprises currently host unauthorised AI agent deployments, with most operating undetected and holding privileged access to corporate resources, creating a new attack vector that bypasses traditional security controls.
Cloud security vulnerabilities: the unpatchable risks hiding in your SaaS stack
The cloud gives businesses scalability, agility, and built-in resilience. But it’s created a dangerous illusion: that moving workloads to SaaS platforms and managed services automatically makes them secure. Reality: the cloud doesn’t erase risk, it shifts who holds responsibility. You…
Inject one agent, own them all: The cascading risk of multi-agent AI
Ninety percent of organizations are deploying AI agents. Most aren't monitoring what they do. Multi-agent systems amplify this blindspot: one compromised agent cascades through every trusted collaborator. The architecture is scaling. The security is not.
SOC Testing: Turning Your Security Operations Centre into a Continuous Learning Engine
SOC testing isn’t just about finding vulnerabilities. It’s about building collaboration, sharpening human judgment, and turning your SOC into a continuous learning engine.
Why I founded CovertSwarm after annual pen tests failed me
Almost every business I worked for got breached. Our teams did the same thing each time: an occasional pen test, a thick report full of findings, then wait another year. Meanwhile, our attack surface changed daily. That false economy is exactly why CovertSwarm exists.
When a former UK Government cyber operations chief says AI is “limitless” in Offensive Security, we should pay attention
Jim Clover says AI has made offensive cyber "limitless." Attackers are using it now. The horse has already bolted. And if your red team isn't keeping pace, you're not testing against real threats.
What Is Constant Cyber Attack?
CovertSwarm COO Luke Potter explains why traditional testing no longer reflects how real attackers operate. In this piece, he defines Constant Cyber Attack, a discipline built on continuous, real-world emulation that helps organisations outpace genuine threats.
Threat Actors Don’t Wait For Your Annual OT Pen test
Annual OT pen tests provide snapshots. Real attackers operate continuously. This is why your operational technology security strategy needs to evolve.
Humans In The Loop: The Non-Negotiable In Offensive Security
AI and automation have transformed offensive security, but not replaced human ingenuity. Luke Potter explains why real attackers, and real defenders, still need humans in the loop.
CovertSwarm welcomes Jim Jordan as Head of Sales for the U.S. Division
Jim Jordan's leadership and experience in driving growth and client engagement strengthen our mission to deliver constant offensive testing across North America.
CovertSwarm Welcomes James Smith as Hive Leader, Expanding Operational Technology Security Expertise
James Smith joins CovertSwarm as Hive Leader, strengthening our Operational Technology (OT) offensive security expertise CovertSwarm proudly welcomes James Smith as a Hive Leader in the UK, expanding our offensive capabilities into Operational Technology (OT). His appointment strengthens our ability…
Weaponized patience: the strategic implications of the F5 breach
The F5 breach reveals the growing danger of shared infrastructure attacks. As adversaries learn faster than defenders, the only path to resilience is continuous, adaptive testing. This is not about blame, it’s about evolution.
Everyone has a plan until they get punched in the face: reflections on the NCSC 2025 annual review
The NCSC Annual Review 2025 delivers a reality check. Highly significant cyber incidents have increased by 50 percent year over year. It's time to act.
Part 3: CBEST Series – The Future of Threat-Led Penetration Testing
Regulated testing like CBEST is pivotal, but as threats shift, organizations must adopt more strategic, agile threat-led penetration testing. Discover what’s next.
Prime Day Scams – How Attackers Exploit Trust and Urgency
Every Prime Day, fake delivery texts flood inboxes, exploiting shoppers’ urgency and trust. We explain how these scams work and what both consumers and security teams can do about them.