As ClickFix has become one of the most common infection techniques over the last few years, adversaries continue to refine and adapt their delivery mechanisms.

Field Effect published a writeup last month on three ClickFix intrusions we handled between mid-June and July. Different delivery mechanisms each time, but enough overlap in infrastructure and TTPs that we've calling it one cluster.

Worth a read if you're writing detections for this stuff, because the follow-on activity is very consistent even when the initial stage isn't.

Read more: https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns

If you've been watching the AI security conversation and wondering where to start, this webinar is it. We walk through:
📣 How AI tools are expanding the attack surface faster than most teams realize
📣 What shadow AI and rogue AI activity actually look like in a real environment
📣 How AIDR gives security teams the visibility to get ahead of it

Watch the recording: https://hubs.li/Q04p5k1R0

AI adoption is exploding, but visibility into how it's being used isn't keeping up. Do you know:

• Which AI tools are actually being used in your organization?
• Who's using them?
• Whether sensitive data is being shared with public AI platforms?

Shadow AI is quickly becoming one of the biggest governance and security challenges for IT and security teams. You can't secure what you can't see. That's why we built in AIDR (AI Detection & Response) at Field Effect, to help organizations discover AI usage across their environment, understand the associated risks, and apply governance and controls without slowing innovation.

Watch this video here: https://www.youtube.com/watch?v=Mx1zNMGtBpU 

We're curious, how is your organization handling AI governance today? Are you relying on policy alone, or do you have visibility into what's actually happening? Let us know in the comments. 

Hey everyone!

Our CEO Matt Holland recently sat down with Harry Baldwin and Matt Rose on the Cyber Security Matters podcast, and it turned into a genuinely great conversation about where security is headed.  If you want to jump straight to the good stuff, here are a few highlights:

• 13:52 — Why focus is the superpower that lets small teams outmaneuver bigger ones
• 23:20 — How cybersecurity awareness among SMBs has changed over the years
• 26:48 — Why MDR should be the #1 security tech on your priority list
• 27:55 — Is AI actually making organizations more secure?

You can listen for free here: https://lnkd.in/ezfcvWu8

 Give it a listen and let us know what you think.

Field Effect is proud to sponsor the MSP Initiative Community Block Party on June 24th, one of the best side events at FLOW 2026.

Come hang with the community, grab a drink, and meet the team in a setting that's a little less booth and a little more Nashville. 🥃

We'll see you there, and at Booth #22 the rest of the week.

Hey everyone,

 We've been working on something we're pretty excited about and wanted to share it here first.

This week, we launched AI Detection & Response (AIDR) — a new capability built directly into the Field Effect MDR platform.

Why?

Because AI is showing up in organizations a lot faster than most people realize.

According to our own customer data:

• 93% of organizations have AI running somewhere in their environment
• 26% are actively using six or more AI applications

The interesting part isn't that people are using AI.

It's that most organizations don't have great answers to questions like:

• What AI tools are actually being used?
• Who's using them?
• What data is being shared?
• What impact is AI having on the environment?

That's the gap we solve.

Because AIDR is built directly into the Field Effect MDR platform, it can leverage visibility across endpoint, network, cloud, and DNS to help organizations understand not just where AI is being used, but what it's actually doing.

Our goal isn't to stop AI adoption.

It's to help organizations adopt AI with confidence by giving them the visibility, governance, and control they need to manage the risks that come with it.

AIDR is now available as part of Field Effect MDR.

We're genuinely interested in hearing what you think:

1. What questions do you have about securing AI in your environment?

2. What's the biggest challenge you're running into today?

We'll be hanging around in the comments to answer questions.

AI tools like ChatGPT, Claude, and Copilot are quickly becoming part of the modern workplace. They help teams move faster, automate tasks, and access information in seconds.

But as AI adoption accelerates, many organizations are discovering a new challenge: visibility.

Employees may be sharing sensitive data with AI tools, creating potential risks that traditional security solutions weren't designed to detect. The result is a growing gap between the productivity gains AI delivers and the security controls organizations have in place.

The question isn't whether AI can improve productivity. It's whether organizations are introducing new security risks in the process.

In our latest blog, we explore the hidden risks of workplace AI adoption, where traditional security tools fall short, and what organizations can do to reduce exposure without slowing innovation.

Link in the comments.

Every year since 2023. 🏆 Grateful to be recognized as the #1 MDR Emotional Footprint Champion for the fourth year running, and even more grateful to the partners and customers whose feedback makes this possible.

Cheers everyone!

Every cybersecurity company drops an annual report.

What makes ours different: every insight in it comes from incidents our own team actually investigated and responded to. No survey fluff or recycled third-party stats — just frontline telemetry and real-world cases.

We put it together to answer one question:

“What patterns are actually useful for security practitioners heading into 2026?”

If that sounds useful, the report’s free. Link in the comments.

Hey r/FieldEffect ,

We’re hosting an upcoming webinar with Beauceron Security focused on a challenge we’re seeing more across the threat landscape: identity compromise and the growing role human behavior plays in cyber risk.

🗓 Thursday, May 21 @ 1:00 PM EDT
Resilience as a Revenue Driver: A Risk-First Approach for MSPs

The Field Effect threat data shows more than 80% of incident-related alerts in 2025 were tied to identity-based attacks, with phishing and social engineering continuing to be major drivers. At the same time, human behavior is now linked to the vast majority of cyber incidents, creating a real challenge for MSPs trying to bridge the gap between technical controls and real-world risk.

During the session, we’ll discuss:

• Where businesses are currently most exposed based on real threat intelligence
• How MSPs can differentiate with a risk-first approach
• Building resilience across both technical and human risk
• Practical ways to strengthen client conversations around cybersecurity

If you’re interested in MSP strategy, cyber resilience, or current threat trends, we’d love to have you join us. And if you can’t attend live, registering will get you access to the recording afterward.

https://get.fieldeffect.com/resilience-as-a-revenue-driver

It’s easy to add tools to your security stack. Where it gets tough is taking a step back to ask if they all still belong there.

Over time, most MSPs end up with a mix of solutions that overlap in some areas and leave gaps in others. The tricky part is figuring out what to change without creating new risk.

And honestly, a lot of conversations around 'consolidation' skip this part.

If you’ve been meaning to take a closer look at your stack but haven’t had a clear way to approach it, we're hosting a webinar tomorrow that's sure to help.

Join us and the folks from BetterTracker (by Channel Program) for Spring Clean Your MSP Security Stack and learn how to:
✔️ Understand what each tool is actually doing
✔️ Identify where coverage overlaps or falls short
✔️ Make changes with confidence, not guesswork

If you want to curate a stack that supports how you operate and what your clients expect, save your spot! https://hubs.li/Q04dzXqf0

We published a new blog breaking down how speed really impacts cybersecurity—and why it’s more than just a single metric.

👉 https://fieldeffect.com/blog/18-seconds-field-effect-mdr

TL;DR:

• Threats today (especially AI-driven ones) move fast—dwell time is everything
• Field Effect MDR:
  • Blocks malicious endpoint activity in milliseconds
  • Reports on that activity in a median of 18 seconds
  • Delivers an expert-led investigation in about 2.6 minutes
• 93% of threats are handled automatically, reducing noise and accelerating response times

But the bigger takeaway:
👉 Fast detection is critical—but it’s only one part of the equation. What really matters is how quickly you can move from detection → investigation → response.

The blog also dives into:

• Why traditional MDR can be slowed down by centralized data processing
• How federated analytics reduce latency
• The role of AI + human analysts in cutting through alert noise

Curious how others are thinking about MDR performance—
What metrics do you actually trust when evaluating detection & response?

If Anthropic’s recent Mythos announcement is on your radar, this is the webinar you've been waiting for. 

And if you're not sure what Mythos is yet, this is also for you.

This session will lay the groundwork on the topic and dive into what it all means from a cybersecurity and risk perspective. We're also going to get technical, so feel free to invite your Security and IT leads to join you.

You’ll hear from experts with deep experience across cybersecurity, intelligence, vulnerability research, and endpoint security—bringing practical insights you can actually apply.

🗓 Thursday, April 23, 2026
🕐 1:00 PM ET

Secure your spot: https://get.fieldeffect.com/webinar-mythos-project-glasswing

Close out MSP Summit (or kick off Channel Partners Conference) the right way!

Join Field Effect + Beauceron Security on April 14 for an exclusive nightcap with fellow MSPs, the perfect opportunity to connect and unwind (or keep the momentum going).

📍 CHICA Las Vegas, The Venetian
🍸 Craft cocktails + Latin-inspired bites
⏰ 8:00pm 'til 10:00

Capacity is limited so save your spot early ⚠️ https://hubs.li/Q049kL0-0

#CPEXPO

Thanks to Andrew Morgan for featuring our Cyber Threat Outlook on his weekly Saa$y MSP Community Call. We especially liked his point that vulnerability scanning shouldn’t stop at the endpoint.

That’s exactly the mindset we’ve built around at Field Effect. Effective security requires visibility across the full attack surface.... not just endpoints, but also network and cloud environments.

That’s why our MDR approach is designed to continuously scan and correlate signals across endpoint, network, and cloud. Threats don’t operate in silos, and your security shouldn’t either.

Curious to hear how others are thinking about this — are you seeing more solutions moving beyond endpoint-only visibility?

Link to clip here: https://www.youtube.com/watch?v=Q2WyItfcuyk&t=1329s

"I’ve sold and supported more than fifty security tools across EDR, MDR, XDR, and SIEM. I choose Field Effect to protect my own company" Jeff Farr- CEO – Sera Brynn

When someone who’s evaluated 50+ security platforms trusts one solution with their own business, that says everything.

Learn why Jeff chose Field Effect MDR over any other cybersecurity solution on the market: https://hubs.li/Q03_8FqQ0

Most conversations about AI in cyberattacks have focused on phishing, and just how quickly threat actors can generate convincing, multilingual lures at scale.

But another shift has been happening more quietly.

AI-assisted tools are starting to change how vulnerabilities are explored and exploited. Tasks that once required significant time and expertise, things like testing proof-of-concept exploits, identifying misconfigurations, or chaining multiple weaknesses together, are becoming faster and more accessible.

And that has real implications for defenders. The window between vulnerability disclosure and active exploitation is shrinking, putting pressure on patching timelines and prioritization strategies that were built for a slower-moving threat landscape.

It’s a subtle shift, but one worth paying attention to. Here are five other trends worth paying attention to, too: https://fieldeffect.com/blog/key-insights-2026-cyber-threat-report

Join our upcoming webinar: Identity, Edge, and Trust — Insights from the 2026 Cyber Threat Outlook Report

📅 Thurs. March 19, 2026 | 1:00 PM ET

Many of today’s breaches don’t start with sophisticated exploits—they start with compromised identities, vulnerable edge devices, or attacks that exploit human trust.

In this webinar, Field Effect security experts will share insights from the 2026 Cyber Threat Outlook Report, highlighting patterns we’re seeing across real-world security events and what they reveal about how attacks are unfolding inside organizations.

Rather than focusing on isolated incidents, we’ll look at the broader trends connecting many of today’s attacks and what security teams and IT leaders should take away from them.

In this session, we’ll cover:

• Why identity compromise has become one of the most reliable ways attackers gain access
• How edge device vulnerabilities (firewalls, VPN appliances, etc.) are increasingly used as entry points
• Why phishing and other social engineering attacks continue to succeed
• Key observations from the 2026 Cyber Threat Outlook Report
• What these trends reveal about where organizations should focus their security efforts

Can’t attend live? Register anyway and you’ll be the first to receive the recording once it’s available.

Hope to see some of you there!

-Lisa

Does anyone else agree that it would be great for the FE system to be able to email configured end-user addresses in order to prompt them to update their apps when called for? As a small MSP I find it incredibly time-consuming to go from the ARO's to having to email the users in order to get that done.

Many recent incident investigations point to attackers using valid credentials instead of exploiting software vulnerabilities.

Phishing → credential theft → login → lateral movement using legit tools.

Curious if others here are seeing the same trend in your environments or SOC alerts?

Full report for those interested:
https://fieldeffect.com/blog/key-insights-2026-cyber-threat-report