Threat intelligence Archives

10 questions to ask before you trust someone else’s intel

Expel’s 2026 Annual Threat Report

Live from RSAC 2025: Dave Merkel on AI, identity, ransomware, and more

See this interview from RSAC 2025 with Dave Merkel of Expel on new threat intel, the geopolitical landscape, and the role of AI in cyber.

Roundtable | On Scattered Spider and the Atlas Lion threat group

Experts discuss the Atlas Lion threat group, a Scattered Spider subset, its innovative cloud attacks, and how to defend against their tactics.

MITRE ATT&CK in AWS

MITRE ATT&CK in Azure

MITRE ATT&CK in Google Cloud

MITRE ATT&CK in Kubernetes

MITRE ATT&CK in Oracle Cloud Infrastructure

Annual Threat Report 2025

2024 Cybersecurity Enhanced Resilience Checklist

Our report surfaces the most significant data we’re seeing in our threat detection and response efforts and offers resilience recommendations to protect your organization.

Annual Threat Report 2024

Quarterly Threat Report – Q3 2023

Threat Report Q2 2023: Webinar

Quarterly Threat Report – Q2 2023

Threat Report Q1 2023: Webinar

Quarterly Threat Report – Q1 2023

The Silicon Valley Bank Collapse Fallout: How to Protect Your Business Against BEC

Quarterly Threat Report – Q3 2022

Quarterly Threat Report – Q2 2022

Quarterly Threat Report – Q1 2022

Inside an investigation: compromised AWS access keys

Hear how we caught an attacker that used a developer’s machine to gain access to AWS.

Azure guidebook: Building a detection and response strategy

Stories from the SOC: Investigating a phishing attack

Phishing investigation walkthrough: Expel's Ray Pugh shows how analysts confirm intent, find who was compromised, and get left of the threat quickly.