Blog

Hunting Our Own Vulnerabilities First: Tanium’s Frontier AI Security Commitment

Tanium is using frontier AI models to hunt vulnerabilities in its own software before anyone else can. Here's what we're learning, and why customers should expect more security advisories and patches.

Hunt or be Hunted: Hunting RunMRU for Credential Exposure

A hunting playbook built for ClickFix went looking for pasted commands and found a working credential to a third-party portal instead.

Hunt or be Hunted: FalconFlank Zero-Day

Within 48 hours of the FalconFlank exploit's release, Tanium HuntIQ built seven behavioral detections and a single Atlas hunt prompt to catch attackers who turn CrowdStrike Falcon's own privileged clean-up against itself. See how Tanium Atlas sweeps an entire Windows fleet for the exposure in about a minute.

Hunt or be Hunted: ShieldBreak Zero-Day

Learn how Tanium HuntIQ turned a Windows Defender zero-day into a tested mitigation before a CVE was assigned.

The clock is ticking: Your roadmap to 31st October 2026

Along with the Bank of England in May, the ECB is requiring organisations to produce an action plan against AI-driven cyberattacks. What it wants, however, is not a strategy paper but proof of operational readiness.

Critical macOS Screen Sharing Authentication Bypass — Under Active Exploitation (CVE-2026-65400)

CVE-2026-65400 is a pre-authentication vulnerability in the macOS Screen Sharing daemon (screensharingd) that lets a network attacker authenticate without valid credentials and gain root-level remote code execution. Apple patched the flaw on August 6, 2026, in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9, but after reports of active exploitation, CISA rescored it from 7.1 to 9.8 (Critical) on August 14 and added it to the Known Exploited Vulnerabilities (KEV) catalog on August 18, giving federal agencies until August 21, 2026 to remediate.

Slash Commands Bring Expert SecOps Workflows to Atlas

With /hunt, /investigate, and /signal, Atlas turns a simple chat interaction into a guided SecOps workflow grounded in live endpoint state.

ShieldBreak: The Windows Defender 0-Day with No Patch — And What to Do About It.

A public proof-of-concept called ShieldBreak fully bypasses Microsoft's patch for the Windows Defender privilege-escalation flaw known as RoguePlanet (CVE-2026-50656, CVSS 7.8), letting an attacker who already has local code execution reach a SYSTEM-level shell on Windows 11 25H2 and Windows Server 2025 with a reported 100% success rate. No Microsoft fix currently closes this bypass. Deploy the interim mitigation in the Guardian dashboard and hunt for the associated exploitation indicators until one ships.

Tanium and Google Threat Intelligence bring Google-grade threat intel to the live endpoint

Introducing Agentic SecOps: Live Endpoint Truth for the AI-Driven SOC

Agentic SecOps changes the operating model: with Tanium Atlas, security teams can direct work in natural language, reason over live endpoint data, and keep humans in control.

Bringing Tanium’s real-time endpoint intelligence into enterprise AI workflows with MCP

Tanium Atlas MCP Server helps security and IT teams safely connect AI clients and agents to governed endpoint data, so investigations and operations can move faster without sacrificing control.

Tanium’s Summer Intern Program: A Launch Pad to Leadership in Cybersecurity

A look at Tanium’s leading summer internship program – and why it’s a great option for students and professionals entering cybersecurity.