Steve Faruque

Traditional detection assumes data is not code, trust boundaries are clear, and systems behave deterministically.

• In agentic systems, they argue, data becomes executable instruction, external and internal context blend together, and models interpret intent rather than follow literal commands.
• The result is an attack with no malware, privilege escalation, or suspicious network traffic — only legitimate-looking activity on approved domains.
• They describe the pattern as "cross-site scripting for the AI era": a malicious prompt planted in ordinary business data that fires later, sometimes weeks after it was placed, when a routine query triggers the leak.

The worked case is the ForcedLeak vulnerability in Salesforce Agentforce, which Faruque credits to researchers at Noma Security.

• They explain how indirect prompt injection turned autonomous AI agents against their own organizations and quietly leaked CRM data.
• They outline the wide attack surface agents carry — knowledge bases, executable tools, memory, autonomous workflows — and note that, from a monitoring perspective, the activity looks like an agent doing its job: retrieving data and responding helpfully.

Read original · Original 2

Instead of finding code defects, attackers can use a system's own designed behavior against it: an AI tool follows instructions, and theirs are simply more convincing.

• They group the resulting breach patterns into four named categories — prompt injection that leads to full system access, agentic intrusions that issue unauthorized database queries and API calls, AI-generated "vibe coded" code carrying hidden SQL or logic flaws, and AI-accelerated zero-days that shrink reaction windows from weeks to hours.
• They pair the threats with a cost contrast to make the scale legible.

Faruque cites an average data breach cost of $4.88 million, compared with AI-enabled attacks that can be launched at machine scale for roughly $50 in API costs. The Salesforce ForcedLeak case appears again as an example of prompt injection that produced full CRM access.

Read original

For teams starting out, they suggest delimiter "spotlighting" to isolate model inputs, a security code review checklist for every AI feature pull request, basic request logging with a small number of anomaly alerts, and open-source guardrails.

• For teams with more resources, they recommend commercial prompt-shield products, behavioral anomaly detection that flags unusually large data access, output filters that block external URLs and excess personal data, and monthly automated red teaming against the OWASP LLM Top 10.
• The approach gives even a small team with no budget a credible starting point.

Named tools include Guardrails AI, Llama Guard, and NeMo on the open-source side; Lakera Guard and Azure Prompt Shields as paid options; and Garak for automated red teaming. The open-source list also includes free-tier request logging and three anomaly alerts.

Read original

They start from the human cost of detection work and argue that another dashboard or feed makes the problem worse, not better.

• In their framing, analysts need clarity, confidence, and speed — delivered by summarizing complex alerts and offenses in plain language, suggesting immediate and long-term response actions, and answering natural-language questions about tactics and indicators.
• They return to the same theme in release notes, where user and entity behavior analytics are described as surfacing insider threats without drowning analysts in noise.

Faruque's launch post quotes a SOC analyst — \"I'm drowning in alerts. I live in fear of missing the one that really matters.\" — and presents an investigation assistant credited to watsonx.ai as the response, contrasting it with \"not another dashboard.\" They link a free app, a launch blog, and technical documentation.

Read original · Original 2

They co-host and promote live sessions, name co-speakers and partner speakers, and, in release material, thank colleagues and attendees who joined a walkthrough.

• They treat the people behind a product as part of the story, not background.
• The material follows the same pattern: short hooks, bulleted warning signs or features, one concrete case, and a next step such as a recording link, registration page, or invitation to connect.

Faruque promoted a one-hour QRadar Unlocked session with Mark Precious of CarbonHelix, offering separate registration links for IBM staff and for partners and the public.

• They took part in a Pioneering Minds AI panel on the anatomy of AI-powered attacks in New York, thanked the organizers and attendees, and promoted a December 12 session with named co-speakers and a virtual option for people outside the city.
• In the release roundup, they wrote that products are nothing without the people behind them and credited the more than 100 attendees along with a long list of speakers.

Read original · Original 2 · Original 3 · Original 4 · Original 5

The technical cases are attributed to outside researchers, and the posts do not present original measurement, a dataset, or a tool built by Faruque. One tension matters to buyers: the same body of writing describes AI agents as a serious new attack surface and promotes AI features for security operations, without addressing that tension directly.

The ForcedLeak vulnerability is presented as the work of researchers at Noma Security, not as Faruque's own disclosure.

• The QRadar material comes from inside a specific product story, describing features and releases rather than independent testing.
• Buyers evaluating the claims should ask for independent test results.

Read original · Original 2 · Original 3 · Original 4 · Original 5

A newcomer reading one item should start here: it explains the mechanism and why it hides.

The post uses one case—the ForcedLeak vulnerability in Salesforce Agentforce, found by researchers at Noma Security—to explain indirect prompt injection.

• It lists what makes AI agents a wide attack surface (knowledge bases, executable tools, memory, autonomous workflows), compares the technique to cross-site scripting for the AI era, and explains why traditional assumptions break down: data becomes executable instruction, external and internal context mix, and models interpret intent rather than follow commands.
• The concrete payoff is the detection gap: no malware, no privilege escalation, no suspicious network traffic—just approved domains and normal-looking agent output, with a payload that can sit dormant for weeks.
• It closes with an invitation to connect for practical takes on the AI-native attack landscape.

For brands planning a campaign

A vendor creating an explainer on prompt injection and agentic threats can use this structure: name one vulnerability, then explain why conventional indicators fail. The campaign decision: lead with the detection blind spot, not the vulnerability disclosure, because that is what makes the topic matter to security buyers.

It is the most operational item in the set, giving readers a shippable starting stack rather than a warning.

The post groups new breach patterns into four named categories: prompt injection leading to full system access, agentic intrusions that run unauthorized database queries and API calls, AI-generated code with hidden SQL or logic flaws, and AI-accelerated zero-days that shrink reaction windows from weeks to hours.

• It argues that attackers weaponize intended functionality rather than bugs, and pairs two cost figures: an average breach at $4.88M against AI-enabled attacks launched for about $50 in API costs.
• The defense lists are split by budget, covering input handling such as delimiter spotlighting, security code review checklists for AI pull requests, request logging with anomaly alerts, and open-source guardrails (Guardrails AI, Llama Guard, NeMo), followed by paid options (Lakera Guard, Azure Prompt Shields), behavioral anomaly detection, output filters, and monthly automated red teaming against the OWASP LLM Top 10 with Garak.
• It also promotes a December 12 session with named co-speakers and offers a virtual version for people outside New York.

For brands planning a campaign

This is the strongest evidence that the creator can take a technical explainer through to remediation, usually the hardest part of vendor content to source. The campaign angle is a two-tier resource—free and paid tooling—so a vendor can position its own product in the paid tier without making the piece read like a sales pitch.

Read it for the vendor-launch register.

The post opens with an unattributed quote from a SOC analyst about drowning in alerts and fearing the one that matters, then frames the release against that pressure: not another dashboard, not another feed, but a real-time partner for analysts.

• It describes three capabilities in plain terms: summarizing complex alerts and offenses in human language, suggesting immediate and long-term response actions, and answering natural-language questions on topics from MITRE tactics to indicators of compromise.
• Links to a free app, a launch blog, and technical documentation follow, along with thanks to a long list of named colleagues.
• The product is credited to watsonx.ai.

For brands planning a campaign

A useful model for launch content that leads with practitioner workload rather than capability. For a brief about analyst-facing tooling, this post shows the creator can frame the human problem and make an AI feature legible to buyers who are not analysts themselves.

The post catalogs a release cycle in five named features: an AI-powered investigation assistant that produces natural-language attack-vector summaries and instant AQL generation powered by a Llama model; user and entity behavior analytics for surfacing insider threats; an attack timeline marked coming soon; tiered hot and warm storage for cheaper long-term retention; and rule versioning with audit trails and rollback. It then shifts to the people behind the products, thanks the more than 100 attendees of a walkthrough session, links a recording, and credits a long list of named speakers.

For brands planning a campaign

The post demonstrates a repeatable launch format a vendor could commission: capability by capability, with an explicit split between available and upcoming. It also shows the creator publicly crediting named colleagues, useful when a campaign needs a credible internal spokesperson rather than an anonymous product voice.

Read it to assess whether the tone suits co-hosted or partner-led campaigns.

The post promotes a one-hour May 29 session titled QRadar Unlocked with Mark Precious from CarbonHelix, promising demos, roadmap reveals, and war stories, alongside new AI features, detection-engineering insights, and live Q&A. It addresses experienced QRadar users and newcomers, keeps the tone light with a coffee line, and provides separate registration links for IBM staff and for partners and the public.

For brands planning a campaign

This is a partnership template: a vendor and an outside speaker, with one registration page per audience. A campaign considering a co-hosted webinar or partner-led event can use it to assess whether the creator will share the stage and tailor logistics in the copy for each audience.

Using the ForcedLeak vulnerability in Salesforce Agentforce as the worked case, they describe indirect prompt injection that turns autonomous AI agents against their own organizations and quietly leaks CRM data.

• The post explains agents’ wider attack surface, including knowledge bases, executable tools, memory, and autonomous workflows, and calls the pattern “cross-site scripting for the AI era”: a malicious prompt planted in ordinary business data that fires later.
• They list the assumptions that no longer hold in agentic systems: data is not code, trust boundaries are clear, and behavior is deterministic.
• A companion post widens the list to prompt injection leading to full system access, agentic intrusions issuing unauthorized database queries and API calls, AI-generated “vibe coded” software with hidden logic flaws, and AI-accelerated zero-days that shrink reaction windows from weeks to hours.

For brands planning a campaign

This is the closest match to a brief on educational content about AI-native detection. The three broken assumptions and dormant-payload example give a technical explainer a ready structure, while the agentic attack-surface list can anchor diagrams or a detection checklist.

Examples: Source 1 · Source 2

For earlier-stage teams, they recommend delimiter spotlighting to isolate model inputs, a security code review checklist for every AI feature pull request, basic request logging with a few anomaly alerts, and open-source guardrails such as Guardrails AI, Llama Guard, and NeMo.

• For teams with more resources, the list moves to Lakera Guard or Azure Prompt Shields, behavioral anomaly detection that flags unusually large data access, output filters that block external URLs and excess personal data, and monthly automated red teaming against the OWASP LLM Top 10 using Garak.
• They frame the stakes with two numbers: an average data breach cost of $4.88 million and machine-scale AI attacks launched for roughly $50 in API costs.

For brands planning a campaign

A tiered, named-tool format is straightforward to adapt into vendor content, and the zero-budget stack is a strong hook for readers who cannot buy tooling this quarter. The cost contrast gives a technical explainer a plain-language opening without requiring new data.

Examples: Source 1

One opens with a SOC analyst quoted as saying they are drowning in alerts and live in fear of missing the one that matters, then positions an AI investigation assistant as a partner that simplifies noise rather than adding another dashboard or feed.

• Faruque emphasizes clarity, confidence, and speed through plain-language alert summaries, suggested immediate and long-term response actions, and natural-language answers to questions about MITRE tactics and indicators of compromise.
• QRadar release notes make the same point through user and entity behavior analytics that surface insider threats without drowning analysts in noise.

For brands planning a campaign

Alert fatigue is a strong opening for detection content and pairs naturally with the prompt-injection material. A campaign can lead with the analyst experience and move into the technical attack mechanics, giving the explainer a reason to exist beyond feature description.

Examples: Source 1 · Source 2

They announced the QRadar Investigation Assistant powered by watsonx.ai with links to a free app, a launch blog, and technical documentation, and credited a long list of team members by name.

• A later post summarizes a feature-packed 2025 release: an AI-powered investigation assistant using a Llama model for natural-language summaries and AQL generation, user and entity behavior analytics, an attack timeline described as coming soon, hot and warm storage tiers, and rule versioning with rollback and version comparison.
• Faruque also promoted IBM QRadar Unlocked on May 29 alongside Mark Precious of CarbonHelix, promising new AI features, detection engineering insights, live demos, and a live Q&A.

For brands planning a campaign

Faruque can clearly carry product and release education, including feature walkthroughs and launch posts. This material is written from inside a specific product story, so a neutral category explainer would need different framing from the QRadar-centric posts.

Examples: Source 1 · Source 2 · Source 3

Faruque often names collaborators and speakers and promotes panels and webinars, suggesting a presenter and community-organizer role alongside writing. The technical cases are attributed to other researchers rather than to Faruque’s own disclosure work.

Practical breakdowns built around named vulnerabilities, tool tiers, and event promotion rather than published research.

Technical claims are presented as summaries of others’ findings; the posts show no original vulnerability research, benchmarks, or proprietary data.

For brands planning a campaign

The posts position Faruque as an explainer and presenter. For a campaign requiring original research or first-party testing, ask for relevant examples before commissioning.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

They describe the QRadar Investigation Assistant powered by watsonx.ai, AI investigation summaries, user and entity behavior analytics, and tiered storage.

• They thank named IBM colleagues and link IBM launch blogs and documentation.
• A webinar listing they promote offers IBMers a separate registration path.
• Their job title and team name aren’t stated; ask what role they hold on the QRadar team.

View example

The posts also list them among the speakers for a 12 December session covering how the Salesforce ForcedLeak attack vector worked, detections to catch it, and a zero-budget defensive stack.

• Their co-speakers are Paul Mander, Jeffrey Ze Chong Hang and Anthony M.
• C.
• Neither post discloses sponsorship or payment.

View example

The session covers new AI features, detection engineering insights and a live Q&A. The post presents it as a joint webinar; sponsorship or payment isn’t disclosed.

View example

A Microsoft Sentinel home lab takes a beginner from an empty Azure subscription to a working SOC: log ingestion, KQL, a hunt for failed logins on Event ID 4625, an analytics rule, a triggered alert, an incident investigation, then automation.

• An 18-page field manual on reading a pentest report explains how separate weaknesses chain into a real attack path.
• Like Faruque, Yildiz names the stages rather than the buttons and asks what an alert actually means.

Yildiz writes from the practitioner's bench: standing up a lab, writing detections, reviewing a test report and pushing pentest findings toward detection engineering.

• Faruque's AI posts take the opposite route, opening with a named vulnerability and the assumptions it breaks.
• Much of their material is tied to a specific product or event promotion.
• Yildiz also credits another author for one walkthrough; Faruque's QRadar posts are written from inside the vendor story.

Read original · Original 2

One post separates behaviour analytics—user, entity, process and network anomaly detection across Defender, Falcon, Splunk and others—from behavioural threat intelligence, which places activity inside an attack campaign.

• It asks what an anomaly means, not just whether something unusual happened.
• The other post, on the Open Cybersecurity Alliance Indicators of Behaviour project, argues for representing how an attacker behaves in STIX 2.1, not only the artifacts they leave.
• Both writers contrast an older model with what a newer one has to answer.

Karanjalkar focuses on definitions and standards: vendor-neutral data models, STIX 2.1, interoperability between security tools and open questions for readers.

• Faruque works from concrete cases such as the ForcedLeak vulnerability, as well as named tools and budgets.
• Much of their output is product-launch and event material rather than conceptual framing.

Read original · Original 2

One post describes an agent that reviews identity history, endpoint processes, network and cloud data, builds a timeline and recommends containment to an analyst.

• It argues that autonomy must be earned through least-privilege access, approved tools, clear action boundaries, audit trails and human approval for high-impact decisions.
• That is the same framing Faruque uses, presenting AI as a partner for analysts rather than another dashboard.

Sharma writes broadly about technology leadership and workforce change across healthcare, logistics, customer service and governance, including which roles may shift.

• Their security piece makes a conceptual case for where to deploy an agent.
• Faruque stays within security, anchors threat discussions in a named vulnerability and writes launch and release material for a specific product.

Read original · Original 2

The reviewed work is procedural.

• One post walks readers through a Microsoft Sentinel home lab, from creating an Azure subscription and a Log Analytics workspace to enabling Sentinel, connecting Windows security logs, writing KQL, hunting failed logins by event ID, turning the hunt into an analytics rule, and investigating the resulting incident.
• It frames the exercise as learning SOC operations by building a lab rather than memorising what a SIEM does.
• The other presents an 18-page field manual on reading a pentest report, arguing that a useful report shows how compromise actually happens: scope, attack path, evidence, root cause, remediation, retest, plus the debrief question of which tester actions the security controls should have detected.
• Both sit closer to a lab exercise or course than to a vendor explainer.

Choosing Okan Yildiz means giving up direct coverage of AI-native attacks.

• The posts do not address AI-native attacks, prompt injection, or agentic intrusions, and the detection work is tied to a specific stack rather than the AI agent attack surface.
• The home lab post walks through a guide credited to a third party, teaching through annotation rather than original design.
• The posts answer a different reader question: “How do I build and test this?” rather than “Why does this attack evade my current defenses?”
• Steve Faruque's posts cover the attack mechanics, named case, and cost contrast the explainer needs, so Okan Yildiz would be the stronger choice for an assignment aimed at practitioner enablement.

Examples: Source 1 · Source 2

One post explains the Open Cybersecurity Alliance Indicators of Behaviour subproject under the OASIS Open ecosystem, which uses STIX 2.1 to represent how an attacker behaves, covering initial access, privilege escalation, credential access, lateral movement, persistence, command and control, and data staging and exfiltration.

• The aim is to make behavioural intelligence shareable in a machine-readable way that complements traditional indicators of compromise.
• The other post distinguishes Behaviour Analytics, which flags that something is unusual, from Behavioural Threat Intelligence, which places that activity in a wider campaign and says what the attacker is likely to do next.
• For a piece arguing that detection should move from anomaly flagging to understanding intent, this is a stronger starting point.

The tradeoff is concreteness and audience.

• The posts say less about how a named attack works: there is no prompt injection walk-through, agentic-data-exfiltration case, or breach cost or attacker cost figures.
• A technical explainer would therefore lean on concepts rather than specifics a security buyer can test against their own stack.
• The work is also aimed at a strategy-minded reader, making it better suited to an opinion or direction piece than an operational one.
• Both posts offer analytical commentary on a standards project and a category distinction rather than hands-on practice.
• Steve Faruque's posts carry the case-level detail needed for a technical explainer about a specific attack; Makarand Karanjalkar's work fits better if the assignment is reframed around the case for behavioural intelligence as a category.

Examples: Source 1 · Source 2

One post argues that human-only investigation cannot keep pace with modern attacks and lays out what an agent could do: review identity and authentication history, examine endpoint activity, correlate network, cloud, and threat-intelligence data, build a timeline, and recommend containment.

• It then lists guardrails such as least-privilege access, approved tools, action boundaries, audit trails, and human approval for high-impact decisions.
• A second post steps back to AI as a technology wave, covering governance, ethics, workforce change, and adoption across healthcare, logistics, customer service, and cybersecurity.
• For a leadership-audience piece on the shift to autonomous investigation and how to govern it, this framing is closer to the target.

What is given up is coverage of how attacks work.

• The posts describe what an agent should do and how to govern it; they do not explain how prompt injection, indirect prompt injection, or agentic intrusions work, and name no case study, attack, or measured figures.
• The second post is broader still, touching on cybersecurity among several industries.
• Neither shows hands-on work or first-hand testing; both stay at the level of description and argument.
• Steve Faruque's posts cover the mechanism, named case, and cost contrast that make an AI-native detection explainer land with a security buyer.
• Bharat Sharma's material is better suited to a companion piece for a general or executive reader than to the technical explainer itself.

Examples: Source 1 · Source 2