In partnership with: 

From Reactive to Autonomous IT Operations and Security

When you’re investigating an issue, one of the first things you need to know is what’s happening in your environment right now. If you’re working from an old scan, you’re already spending time validating information before you can act.

As AI accelerates the threat landscape, that delay becomes harder to afford.

That’s the shift Tanium is highlighting at Converge 2026: helping IT and security teams move from reactive to autonomous operations with Agentic Defense.

Atlas is the agentic intelligence layer across Tanium, connecting real-time endpoint visibility with the ability to take governed action.

Underneath that mission control approach is Tanium’s patented linear chain architecture, which enables real-time endpoint communication at scale.

Teams can access capabilities across endpoint management, exposure management, and security operations, while background AI agents continuously monitor environments and surface issues.

What stands out to me is how human control fits into that process. Atlas can execute workflows within boundaries your team defines, bringing operators in for consequential decisions. 

On top of this, actions are governed, auditable, and traceable, so teams can delegate more work to agents while maintaining accountability.

Whether your team is building its automation capabilities or already putting agents to work, that combination of current information, action, and oversight matters.

Check out Tanium Converge 2026 in-person in Las Vegas or virtually to see Tanium Atlas.

^{Cyber News Bytes: Now, What’s Happening in Cybersecurity This Week →}

1. A 21-hospital Ohio health system was offline for 16 days after a cyberattack

University Hospitals, the Cleveland-based system, detected unusual activity on October 22 and disconnected its systems from the internet. Hospitals and emergency departments stayed open, but MyChart, online prescriptions, test results, and bill payments went dark until MyChart returned on November 7. The system hasn't said what kind of attack it was or whether patient data was taken, though a proposed class action alleges it was.

Why it matters: Care continued, but results, refills, and billing all slowed down, which is why health systems need to practice running on paper. If you're a patient, be careful with calls or texts about billing, since University Hospitals says it won't ask for banking details that way.

Read more at HIPAA Journal

2. The Chainalysis breach started as "limited" and ended with every customer's credentials and live tokens exposed

Chainalysis, the blockchain analysis firm used by crypto exchanges and law enforcement, first said on October 30 that only limited profile details were exposed. By November 4 it confirmed that names, usernames, password hashes, and live tokens for all users were exposed, and it took its login page and several products offline. Customers have been told to reset passwords and rotate API keys.

Why it matters: Live tokens mean a password reset alone isn't enough, so after a breach like this, sign out of all sessions and rotate API keys. It's also a reminder that a reassuring first statement that has to be walked back costs trust.

Read more at BleepingComputer

3. A server migration mistake left a DigiCert system exposed to the internet for 16 months

A February 2025 migration left an internal DigiCert system reachable from the internet, with a self-registration feature that let outsiders create accounts. One of those accounts read archived customer data between June 27 and July 2, including names, business contact details, and for some customers, IDs like driver's licenses or passports. DigiCert says certificate operations and customer logins weren't affected, and it hasn't said how many people were exposed.

Why it matters: Keep an inventory of what's internet-facing, turn off self-registration on internal systems, and treat unexplained accounts as incidents until you can prove they can't reach data. DigiCert spotted the accounts in June but didn't confirm data access until October.

Read more at BleepingComputer

4. Hackers are exploiting a SonicWall flaw that can bypass MFA on VPN logins

SonicWall patched seven SonicOS flaws on November 6, including CVE-2026-19868, which is already being exploited. On VPNs that use SAML login, an attacker with valid credentials for another login method can skip SAML and any MFA enforced through it. There's no workaround, so the fix is upgrading to SonicOS 7.3.4-7013 or 8.2.3-8015, and CISA set a November 20 deadline for federal agencies.

Why it matters: MFA only protects you if every login path enforces it. Patch quickly, remove authentication methods you don't use, and review VPN logs for logins that skipped SAML.

Read more at BleepingComputer

This week's stories share a pattern of small gaps that grew over time: a migration that left a system exposed for 16 months, a breach notice that had to be expanded within a week, and a login path that quietly skipped the second factor.

Stay secure out there!
Sandra | Cyber With Sandra