Covers: Vulnerabilities & PatchingDetection & ResponseThreat Actors & Nation-StateZero-Days & ExploitsEndpoint & Network SecurityOT / ICS & Critical InfrastructureData BreachesPhishing & Social EngineeringIdentity & Access ManagementMalware
GreyNoise analyzed 2.97 billion sessions over 162 days in H2 2025 and found Palo Alto GlobalProtect drew 16.7 million sessions, more than 3.5x Cisco and Fortinet combined. The report also found 52% of remote code execution attempts came from IPs with no...
GreyNoise's 2025 Mass Internet Exploitation Report states that in 2024 attackers automated vulnerability exploitation at scale, with scanning and exploitation attempts observed across thousands of IPs. Founder Andrew Morris said attackers scan the entire...
The 2024 Verizon DBIR reports a 180% increase in attacks that use vulnerability exploitation as the critical path to initiate a breach, with exploitation also cutting into the share of breaches started through credential attacks and phishing. GreyNoise's...
The fifteenth Verizon DBIR draws on 914,547 incidents and 234,638 breaches plus 8.9 TB of cybersecurity data, and GreyNoise contributed its opportunistic attacker sensor fleet data to the report. The report's summary covers initial breach techniques...
GreyNoise Intelligence added over 230 tags since January 1, 2022, covering detections for more than 160 CVEs, and its retrospective highlights four vulnerabilities including Log4j, Atlassian Confluence OGNL injection, Apache httpd path traversal and remote...
GreyNoise cites an average drawn from three vendor reports that a single SOC analyst wastes 8.4 hours per week triaging false positive alerts. The company says its data provides context on internet-wide scanners, crawlers, and other suspicious activity...
GreyNoise's January 2022 tag roundup catalogs internet-wide scanning and exploitation attempts it has labeled, including Apache Log4j RCE attempts against CVE-2021-44228 and CVE-2021-45046, Microsoft HTTP.sys RCE attempts against CVE-2021-31166, and VMware...
GreyNoise CEO Andrew Morris described three use cases for the service in a tweetstorm: looking up an alerting IP to see whether it is a known benign scanner like Shodan or Censys, a malicious but opportunistic source, or an IP GreyNoise has never seen,...
GreyNoise announced the appointment of a new Senior Vice President of Adversary Operations, a former Head of Global Signals Operations at Google Threat Intelligence Group who arrived via Google's 2022 acquisition of Mandiant and previously served 12 years...
GreyNoise launched Tactics, which automatically maps attacker sessions captured by its Deception Sensors to the MITRE ATT&CK framework and shows the tactics, techniques, and underlying activity observed after a compromise. The company said its analysis of...
GreyNoise observed 242,666 new scanning IPs geolocating to Hong Kong between March 12 and 18, nearly half of all new scanning IPs it saw that week, and 99.7% never completed a single TCP connection. Of those, 241,964 are labeled spoofable, with GNET INC....
GreyNoise recorded 84,142 scanning sessions against SonicWall SonicOS infrastructure from 4,305 unique IP addresses across 20 autonomous systems between February 22 and February 25, 2026, with 92% of sessions probing a single API endpoint to check whether...
GreyNoise launched the AI Cyber Index on Nov. 12, 2026, a benchmark built from eight years of real attack data that evaluates 46 closed and open-weight models on defensive security tasks. The Index reports per-task capability, refusal rates, and time and...
Adversaries exploited a new OpenSSH authentication bypass on GreyNoise sensors roughly 40 hours after its fix, and GreyNoise captured them adding SSH keys and staging a remote control implant. Over the November 2–9, 2026 analysis period, three hosting...
GreyNoise tracked a single malicious actor, a suspected Chinese speaker possibly operating in UTC+8 and linked to the 'Red Heron' activity Acronis reported, from 7 May 2026 onward across WordPress, Ubiquiti, and ZyXEL targets. The actor's WordPress...
GreyNoise launched the AI Cyber Index, which tests 46 closed and open-weight models across three defensive tasks - Network Detections, File Detections, and Attack Forensics - using 145 problems drawn from eight years of labeled traffic and artifacts from...
GreyNoise's Academic Partnership Program lets institutions join Project Swarm by deploying their own deception sensors in exchange for free access to GreyNoise data for classes, research, and security teams. Each class keeps at least one sensor, students...
GreyNoise's Project Swarm lets organizations deploy lightweight deception sensors on their own infrastructure to record attacker sessions with full fidelity, then analyze payloads and compare traffic against GreyNoise's global baseline. Access requires a...