Blog
Stay ahead with news, opinion and research from the Swarm.
Why So Syscalls? BOF Edition
Ibai Castells explains how moving from high level Windows APIs to lower level syscall usage alters what EDRs observe. It outlines the trade offs and gives non-actionable guidance for defenders on telemetry and mitigation.
Airport Chaos Shows How Fragile Our Infrastructure Really Is
Recent airport chaos revealed how fragile global infrastructure really is. A basic ransomware attack disrupted shared systems, grounding flights worldwide. The lesson is clear: outdated technology and rushed recovery leave industries exposed.
Offensive Security Is No Longer Optional
Gartner’s 2025 research validates what we’ve long believed: to stay ahead of attackers, organizations must embrace continuous, proactive offensive security.
Inside a Red Team OSINT Operation: Mapping the Human Attack Surface
Most organizations focus on infrastructure. Red teams target people. We explore how OSINT is used to map the human attack surface, and why mid-level employees often hold the keys attackers need.
Atlas AI: Local LLM inside Burp Suite
Atlas AI adds LLM-powered analysis to Burp Suite without sending data to the cloud. Built for offensive security teams who need full local control.
Redefining Cybersecurity Value: A CFO’s Take on ROI and Resilience
Cybersecurity is how modern businesses grow with confidence. But only if that investment is tested, validated, and aligned to what really matters.
AI: The Great Equalizer in Cyber Offense
AI has erased the barrier between elite hackers and everyone else. From ransomware to large-scale extortion, attackers are now using AI to compress months of work into days.
Cobalt Strike External C2 Passthrough Guide
Cobalt Strike’s passthrough mode reshapes how red teams use External C2. By taking control of shellcode staging and custom channels, operators can bypass static detections and build covert pipelines that defenders are not ready for.
Part 2: CBEST Series – Operational Resilience
CBEST threat-led testing proves whether your organization can withstand real-world attacks, uncovering hidden weaknesses and driving true operational resilience.
Can AI Really Hack You? The Truth Behind the Hype
AI’s role in cybersecurity has evolved from boardroom buzzword to operational threat. As headlines oscillate between “AI revolution” and “AI apocalypse,” one question persists for security leaders: can AI really hack you? The real answer? It depends on your attack…
Remote Work Security Gaps Still Driving UK Breaches
Despite years of adaptation, organizations are still being breached through remote access blind spots.
Part 1: CBEST Series – Beyond the Checklist
Explore how threat-led penetration testing helps financial institutions go beyond traditional checks to strengthen resilience and meet regulatory expectations like CBEST, STAR-FS and DORA.
EchoLeak: The Zero-Click Microsoft Copilot Exploit That Changed AI Security
AI tools like Microsoft 365 Copilot are changing how organizations work, but they are also introducing new security risks that are harder to detect and even harder to defend. One of the most significant examples to date is EchoLeak, a critical…
Proving Resilience: The Role of Regulator-Led Testing in Strengthening Market Stability.
Red teaming in regulated environments has become essential for organisations facing sophisticated cyber threats. While traditional penetration tests provide value, red teaming goes further – simulating realistic adversary behaviour to test defences under real-world conditions. For UK financial services, this…
The Evolution of EDR Bypasses: A Historical Timeline
The relationship between Endpoint Detection and Response (EDR) solutions and bypass techniques represents one of cybersecurity’s most dynamic battlegrounds. They are a representation of Cybersecurity as a whole as they align with the cat-and-mouse analogy that we often use to…
Billy Giles joins CovertSwarm as Head of Adversary Simulation for North America
CovertSwarm welcomes Billy Giles as Head of Adversary Simulation for North America. With over 24 years of U.S. Air Force cyber operations experience, Billy strengthens our Constant Cyber Attack™ capabilities and accelerates our offensive security growth across the region.
Anatomy of a Breach: Inside the Modern Retail Attack
Retail breaches don’t start with ransomware. They start with people. From social engineering to persistent access, attackers exploit the unseen gaps in your defenses. Learn how modern retail attacks unfold.
Inside BadSuccessor: Privilege Escalation via dMSA in Windows Server 2025
Following our initial coverage of BadSuccessor, this technical breakdown dissects the inner workings of a critical privilege escalation vulnerability in Windows Server 2025.
SWARM INTELLIGENCE: BadSuccessor
A privilege-escalation vulnerability has been discovered in Windows Server 2025's new delegated Managed Service Account (dMSA) feature. Dubbed "BadSuccessor," this flaw allows an authenticated user to gain Domain Admin privileges without complex attack chains.
CovertSwarm named a Sunday Times 2025 Best Place to Work
You deserve to love your job.
Your LLM Security Isn’t as Strong as You Think.
AI models feel secure, until a skilled attacker asks the wrong question the right way.
Retail Under Siege: The Coordinated Cyber Assault on UK’s Top Stores
With Marks & Spencer, Co-op, and Harrods all experiencing significant security incidents within a short timeframe, the pattern suggests a coordinated campaign that demanded immediate attention from security leaders across all retail operations.that demanded immediate attention from security leaders across all retail operations.
CovertSwarm Achieves ISO 22301 Certification
CovertSwarm has been awarded ISO 22301 certification, the internationally recognized standard for Business Continuity Management Systems (BCMS).
AI apps are smart. Until they do something really dumb.
AI apps seem brilliant—until they expose secrets or spill user data without a clue. Behind the curtain? Chaos. Hackers, take aim.