Noise Letter July 2025
Summary: GreyNoise published a report titled Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities, which states that in 80% of cases studied, attackers struck before a vulnerability was made public, with spikes in malicious activity often preceding new CVEs, especially against enterprise edge tech like VPNs and firewalls. The newsletter also notes the company's third NoiseFest at BlackHat and DEFCON in Las Vegas, a planned transition from v2 to v3 APIs, and a call for Active Development Partners to apply Suricata Rules and network packet queries to its historical dataset.
Bottom line: If attackers are active weeks before a CVE is published in 80% of the cases GreyNoise studied, a patching program that starts at disclosure is already behind on the edge devices - VPNs and firewalls - that sit at your perimeter.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026