LimaCharlie

New attack types appear faster than most teams can build detection coverage for them. During our recent live demo, Maxime takes a real OAuth consent attack, describes it to Grid, and has detection and investigation running in about 30 minutes. The full session covers how Grid connects to your existing stack, handles repetitive review work across email quarantine, endpoint approvals, and DLP alerts, and produces a full audit trail on every decision it makes, without replacing the tools you already use. Watch the full replay: https://limacharlie.io/webinars?wchannelid=fy1wct3rkg&wmediaid=zeaql0buy7

Strengthen your EDR deployment and detection capabilities in our upcoming virtual workshop. Our LimaCharlie 101 session on July 22nd covers the full arc, from agent deployment to automated response. This is a hands-on session, not a lecture. You'll deploy EDR agents, write detection and response rules, and bring threat intelligence into your workflow live, in real time, on the platform. By the end, you'll have working detections built with your own hands. Register here: https://limacharlie.wistia.com/live/events/4np2oo120j?utm_campaign=101+workshop+7+22+26&utm_source=mastodon&utm_medium=social

Automating security workflows usually means picking a platform and committing your stack to it. Grid takes a different approach: connect a data source, define your approval thresholds, and AI operators run against your existing telemetry on a parallel track. Nothing in your environment moves. That includes the exceptions. The requests that need a human call. The approvals that have to route through a specific channel. Grid handles the full workflow, your way. The full session goes deeper on cross-tenant operations, audit trails, and how Grid continues to improve as you scale. Catch the replay: https://www.youtube.com/watch?v=Iihpjpp9xbw&t=1477s

Hayden Covington, Eric Capuano, and Whitney Champion teach Advanced Security Operations and Threat Hunting at Black Hat. On Wednesday, August 5, they're spending the afternoon with us. This is not a course. It's an open threat hunting lab on live infrastructure, working through real scenarios with no script. Detection engineering, adversary analysis, incident response on infrastructure where every agent is readable and every action is auditable. Ken Westin and Chris Botelho will lead hands-on sessions in parallel for every skill level, from first AI agent deployment to advanced multi-agent pipelines. Free. Wednesday, August 5. 12:00pm to 6:00pm at the Mandalay Bay Horizon Suite. Food and drinks provided. Grab your spot: https://luma.com/black-hat-headless-soc-workshop?utm_source=limacharlie

Most AI in security workshops end with a slide deck and a product pitch. This one ends with something you built. We're hosting a free, hands-on workshop on Wednesday, August 5 at Black Hat alongside Black Hills Information Security and Digital Defense Institute. Six hours. Real infrastructure. No marketing deck. Food and drinks included. Maxime Lamothe-Brassard opens at noon with a short technical talk on the headless SOC, then hands the day to the instructors. Ken Westin and Chris Botelho will lead hands-on sessions for all skill levels. From first AI agent deployment to advanced multi-agent hunting pipelines. Hayden Covington, Eric Capuano, and Whitney Champion will run an open threat hunting lab all afternoon on live infrastructure where every agent is readable and every action is auditable. Space is limited. Reserve your spot: https://luma.com/black-hat-headless-soc-workshop?utm_source=limacharlie

Most AI security products are black boxes. You see the output. You don't see what the agent did to get there.

With Grid, every action an AI operator takes is logged, auditable, and inspectable through the same API surface that created it:

Detection rules written Response actions executed Cases opened Approvals requested and granted

Maxime Lamothe-Brassard walks through the AI workbench in the full session, showing exactly how teams maintain visibility and control over every operator decision.

See it for yourself: https://www.youtube.com/watch?v=Iihpjpp9xbw&t=1477s

Our LimaCharlie 101 virtual workshop is this Wednesday July 22nd, covering everything from EDR deployment to automated threat response. You'll spend two hours working directly inside the platform, deploying EDR agents, analyzing telemetry to surface indicators of compromise, and writing detection and response rules across the threat spectrum from commodity malware to APTs. The session also covers threat intelligence integration, so you can operationalize external feeds directly into your detections, and YARA rule creation for malware identification. Save your spot: https://limacharlie.wistia.com/live/events/4np2oo120j?utm_campaign=101+workshop+7+22+26&utm_source=mastodon&utm_medium=social

Compliance work is some of the most time-consuming work in a managed security practice, and most of it never makes it onto an invoice.

Ken Westin covered how LimaCharlie's compliance tooling changes that in our latest session:

Run a gap analysis against a live client org in seconds and get a prioritized list of what's actually missing

Deploy a case-reviewer AI agent that continuously classifies incidents against the relevant control set and produces structured audit evidence

The LC compliance skill is open source and modifiable, so operators can add frameworks beyond the seven supported out of the box

Available now in the LimaCharlie marketplace. Test HIPAA detection rules for free using Community Edition. https://www.youtube.com/watch?v=O3mPp05Nl7oWatch the full session:

LimaCharlie, Black Hills Information Security, and Digital Defense Institute are taking over a suite at Mandalay Bay on Wednesday, August 5 for a free, full day of hands-on building at Black Hat. Hayden Covington, Eric Capuano, and Whitney Champion will run an open threat hunting lab all afternoon on real telemetry. Ken Westin and Chris Botelho will lead hands-on sessions for every skill level, from first AI agent deployment to advanced multi-agent hunting pipelines. Maxime Lamothe-Brassard will open the day with a short technical talk on the headless SOC. You leave with your own AI-engineered detections and workflows. Every agent readable. Every action auditable. Nothing locked behind a vendor dashboard. 12:00pm to 6:00pm. Food and drinks provided. Space is limited. Reserve your spot: https://luma.com/black-hat-headless-soc-workshop?utm_source=limacharlie

The gap between running a breach simulation and selling it as a recurring managed service is mostly a capacity problem. Grid closes it. Define a kill chain, point it at a tenant, and it runs daily across every client, evaluates coverage, and feeds gaps back to your detection engineering workflow automatically. Maxime covers this alongside Grid's other cross-tenant automation capabilities, including how MSSPs are using it to take on more clients without adding headcount. Watch the demo: https://limacharlie.io/webinars?wchannelid=fy1wct3rkg&wmediaid=zeaql0buy7

Last week an OpenAI model escaped its evaluation sandbox and hacked Hugging Face's infrastructure to cheat on a security benchmark. We recorded a special episode of AI Chat about it. Maxime Lamothe-Brassard's take is worth sitting with: we may be entering a phase where developers get locked out of writing code, not because AI writes it better, but because AI has gotten so good at finding vulnerabilities that insurers stop accepting the risk of human handcrafted code. As Max put it, there's 50 years of historical record showing humans can't write secure code. The full conversation covers the breach start to finish: the malicious dataset, the sandbox escape, the "no malicious intent" framing, and what it means when the attacker is the model. Full episode: https://www.youtube.com/watch?v=yLsK62ieS2E&feature=youtu.be

Grid by LimaCharlie tracks what your AI operators are actually doing: automation rate, analyst hours freed, and cost per case, broken down by model, detection rule, and agent. That data is available through the platform, via APIs, and as downloadable CSVs. For MSSPs, it rolls up across every tenant from a single view. Maxime covers the cost profiling and ROI dashboard, along with Grid's approach to repetitive review work, cross-tenant operations, and audit trails. Stream the replay: https://www.youtube.com/watch?v=Iihpjpp9xbw&t=3s

A CNAPP with a $20,000 entry floor might be fine for one enterprise. Put it on 200 client proposals and it collapses for MSSPs. That math is why no incumbent CNAPP has ever worked for service providers. LimaCharlie Cloud Security, GA today, was built for the other side of it: a complete CNAPP covering GCP, AWS, and Azure for $150 per organization per month. Flat, published, no quote process. It runs on the same multi-tenant agentic SecOps platform MSSPs already use for their operations. Findings arrive as events in each client's own stream, and deploying tenant 5,000 works the same as tenant one: infrastructure as code, no 500-click setup. Cloud security as a default line item on every proposal, priced so there's margin left in it. Start a free 14-day trial: https://app.limacharlie.io/onboard?purpose=cloud-security

Most cloud security tools and EDR platforms don't talk to each other. A misconfigured identity shows up in one dashboard. That same identity's credential used on an endpoint shows up in a different system entirely, usually reconciled through an export pipeline and a SOAR license. Service providers feel it more. CNAPP pricing is built for the end enterprise, sold in opaque billing units, with entry floors that make a resellable midmarket offering nearly impossible to build. LimaCharlie Cloud Security, generally available this week, covers posture management, identity and entitlement analysis, attack-path analysis, and AI security posture management across GCP, AWS, and Azure. Findings don't sit behind an API waiting to be pulled. They land directly in your tenant's event stream alongside endpoint telemetry, so a cloud misconfiguration triggers the same detection logic, routing, and automation as a process event on an endpoint. Pricing matches the architecture: $150 per organization per month, published rather than quoted, with a free 14-day trial on up to two cloud providers. Visible entry floors elsewhere in the category start at $7,000 a month. Start a free trial: https://app.limacharlie.io/onboard?purpose=cloud-security

The most pleasant agentic AI system is the least secure one. That's the trap Rob van der Veer, Chief AI Officer at Software Improvement Group, lays out clearly: the agent that never says "permission denied" is the agent everyone loves to use. It always works. So we open up all the privileges just to keep it that way. He says we should do the contrary. Rob is the founder of the OWASP AI Exchange and co-editor of the forthcoming European AI security standard supporting the EU AI Act. On The Cybersecurity Defenders Podcast, we spoke with him about building trustworthy AI: AI security, threat modeling, international standards, and the new challenges of agentic AI. Full episode: https://www.youtube.com/watch?v=xZX94xC0ceU

Next week at Black Hat, LimaCharlie, Black Hills Information Security, and Digital Defense Institute are hosting a free, hands-on workshop. Most Black Hat sessions send you home with notes. This one sends you home with working AI agents. Ken Westin and Chris Botelho will lead hands-on sessions for every skill level. Hayden Covington, Eric Capuano, and Whitney Champion will run an open threat hunting lab on real telemetry all afternoon. Every action auditable. Nothing locked behind a vendor dashboard. 12:00pm to 6:00pm at the Mandalay Bay Horizon Suite. Food and drinks provided. Space is limited. Reserve your spot: https://luma.com/black-hat-headless-soc-workshop?utm_source=limacharlie

LimaCharlie is now in Claude's official MCP connector directory.

That means anyone using Claude can connect it directly to their LimaCharlie org with no custom integration work, just add the connector and go.

What you can actually do with it:

Ask questions of your telemetry in plain English and have Claude write and run the LCQL for you

Draft, validate, and deploy detection & response rules conversationally

Triage detections, pull process trees, network connections, and sensor state mid-investigation

Manage your fleet — tags, isolation, artifact collection — without leaving the conversation

We think the future of security operations is engineers directing capable agents rather than clicking through consoles. Putting LimaCharlie a single click away inside Claude is a real step in that direction.

Try it here: https://claude.ai/directory/connectors/limacharlie-mcp

This Wednesday the 16th at 10am PT, get a practical roadmap for moving AI in the MSSP SOC from pilots to production. Most guidance on AI in security is written for enterprise teams with one environment to manage. MSSPs need something different: AI that works across dozens or hundreds of client stacks, respects tenant boundaries, and produces results an analyst can defend to a customer. This session covers where AI delivers value first, what your telemetry needs to look like before AI can help, and how to keep humans in control with approval workflows and full audit trails. See it for yourself: https://limacharlie.io/webinars/from-ai-advisor-to-ai-operator?utm_source=mastodon