The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions.

Earlier this month, a server containing credentials stolen from more than 73,000 Fortinet devices was discovered exposed on the internet. Researchers found the server contained downloaded FortiGate configuration files, credentials harvested from compromised devices, and infrastructure used to crack password hashes and perform credential-stuffing attacks.

The campaign was dubbed “FortiBleed” due to the large number of exposed credentials and the massive credential-theft operation.

Follow-up investigations by SOCRadar revealed that the operation used a custom packet-sniffing tool called “FortiGate Sniffer” on compromised FortiGate firewalls, allowing attackers to intercept VPN credentials and other authentication data directly from network traffic.

SOCRadar’s Threat Research Unit (STRU) latest research now ties the credential theft operation directly to members of the INC and Lynx ransomware-as-a-service (RaaS) groups.

The researchers told BleepingComputer that they discovered this link after identifying a Windows server used as part of the FortiBleed infrastructure.

“Our threat researchers identified a Windows server belonging to the FortiBleed infrastructure, which provided further insight into the threat actors’ modus operandi,” SOCRadar told BleepingComputer.

“During the investigation of that server, analysis of the collected artifacts revealed that the threat actor had accessed the ransomware negotiation panels of both the Lynx / INC ransomware group.”

SOCRadar shared screenshots with BleepingComputer showing browser sessions accessing the administration panels for both ransomware groups. The images show negotiation dashboards containing victim chats used during ransomware negotiations.

According to the researchers, this provides direct evidence that an individual with access to FortiBleed infrastructure was also involved with the ransomware groups’ negotiation platforms.

The company also says it identified more than 200 additional operational servers beyond those originally associated with the campaign, discovered victim information harvested during FortiBleed that overlaps with organizations later listed on the INC ransomware leak site, and uncovered evidence suggesting the operation consists of roughly 20 members with defined roles.

SOCRadar also says the campaign was considerably larger than originally understood.

According to the researchers, the operation targeted more than 430,000 FortiGate firewalls worldwide and deployed traffic sniffers on approximately 19,000 devices.

After notifying impacted organizations, the number has fallen to around 11,000 compromised devices. The researchers also say they identified roughly 500 servers used by the operation.

The researchers also believe the attackers exploited a previously undisclosed Nextcloud zero-day vulnerability as part of their operations to expand access after initial compromise. However, technical details have not yet been released.

SOCRadar also told BleepingComputer it found persistent backdoor accounts using the username “adminin” on compromised systems and is continuing efforts to recover ransomware decryption keys.

INC Ransom has operated as a ransomware-as-a-service platform since mid-2023, targeting organizations across healthcare, education, government, and other sectors worldwide.

Lynx emerged in mid-2024 and is believed by security researchers to be a rebrand of the INC ransomware gang rather than a new extortion group.

SOCRadar says a second technical white paper containing indicators of compromise, attribution evidence, and additional technical analysis will be released once its investigation is complete.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

A 360-degree camera records everything in every direction at once. That freedom comes with trade-offs in most models, whether through high prices, fiddly controls, or footage that needs heavy cleanup later. DJI’s first dedicated effort in this category, the Osmo 360, priced at $349 (was $467), arrives with larger sensors than most rivals, strong stabilization, and a price that lands the Standard Combo in a more reachable range for enthusiasts who want immersive video without jumping to the most expensive options on the market.

The camera body is approximately 61 by 36 by 81 millimeters and weighs 183 grams, resulting in a compact brick-like design with lenses on either side and a 2-inch touchscreen on one side of the camera, making it quite simple to navigate. A few physical buttons control power, shutter, and quick view modes; meanwhile, a 1/4-inch tripod thread is neatly tucked away at the bottom, along with DJI’s magnetic fast-release technology, which allows you to use mounts common with its action-cam series. Overall, it’s a little, unobtrusive product that fits neatly into a pocket or attaches onto a bag.

Inside are two 1/1.1-inch sensors with 2.4-micron pixels and f/1.9 apertures. The square design allows the camera to get more information from each sensor for the spherical image, which improves detail and light gathering. You can shoot video in a native 8K resolution (7680 by 3840) at 50 frames per second in full 360 mode, with 10-bit color depth and D-Log M profile support for color grading later if you want to get serious about it. Single lens modes can capture 5K at 60fps or 4K at 120fps for more classic wide-angle shots. For still images, you get a stunning 120 megapixels in complete 360 panoramic form, or approximately 31 megapixels from a single lens.

Real-world footage from reviewers shows some pretty sharp results, decent colors, and a strong dynamic range that holds up in daylight. The bigger pixels significantly improve low-light performance, and there is even a specific SuperNight mode, however very low-light/high-motion movies will require additional post-production effort. Stabilization is excellent, combining RockSteady 3.0 with HorizonSteady to keep vistas flat and smooth out any walking/panning movement. Furthermore, the software does an excellent job of removing hardware from the final spherical file the majority of the time, so you can wave goodbye to a lot of selfie-stick crap.

The battery life is approximately 100 minutes of continuous 8K recording at 30 frames per second with the included 1950mAh pack, and I was pleasantly surprised to see that this actually holds up well in testing. The battery is replaceable and compatible with some of the most recent Osmo Action models, which can be useful when traveling with several devices. Charging is done via USB-C Power Delivery and isn’t too slow; a full recharge takes a decent amount of time given the capacity. Storage is a generous 128 GB to begin with, with approximately 105 GB usable, and there is also a microSD slot that takes cards up to 1 TB, which helps to lessen the need to swap cards mid-shoot on longer days.

Four standard built-in microphones provide great audio, but when you combine the camera directly with DJI wireless microphones, things become interesting. You can connect two microphones to the camera without needing a separate receiver, allowing you to record high-quality speech tracks with the 360 footage. The Standard Combo, which includes the camera, a battery, pouch, cleaning cloth, USB-C cable, and lens cover, is a nice place to start; however, if you want more goods, you might be better off looking at higher-tier bundles or purchasing them individually.

cyber-crime

It’s a ‘complete BEC operations environment,’ Talos researcher says

EvilTokens, the device-code phishing kit that can allow criminals to bypass multi-factor authentication (MFA) and silently authenticate as the victim to the organization’s Microsoft 365 applications, appears to be even more insidious than we all thought.

Cisco Talos incident responders on Wednesday described how the lure reaches a victim’s inbox, and revealed new capabilities alongside a “more sophisticated evasion approach” than documented in earlier EvilTokens research.

Talos uncovered a phishing-as-a-service (PhaaS) operator panel, branded “ARToken,” that appears to be an EvilTokens customer, according to security research engineer Michael Kelley, who noted the phishing operation shares infrastructure, API contracts, and operational patterns with the EvilTokens platform.

EvilTokens was first documented by French cybersecurity firm Sekoia in March, and in April Microsoft said the device-code phishing campaign was compromising hundreds of organizations daily. 

“Since March 15, 2026, we have observed 10 to 15 distinct campaigns launching every 24 hours,” Microsoft VP of security research Tanmay Ganacharya told El Reg at the time. “Each campaign is distributed at scale, targeting hundreds of organizations with highly varied and unique payloads, making pattern-based detection more challenging.”

While most subsequent analysis has covered EvilTokens’ panel and phishing kit, “what it has not shown is how an ARToken lure actually reaches an inbox,” Kelley said on Wednesday. “Talos recovered two near-identical messages, sent roughly four minutes apart on April 20, 2026, that initiate the chain. The tradecraft is targeted, not spray-and-pray.”

Specifically, the email lure abused a real vendor relationship between a US life-sciences company and a legitimate plumbing and fire-protection contractor. The email uses an outstanding-invoice lure, telling the life-sciences company that “the following invoices appear to still be outstanding,” and the “from” header presents the contractor’s real domain. The reply-to, however, redirects replies to an unrelated domain.

Even the visible anchor text in the body of the email reads as the vendor’s genuine SharePoint tenant, we’re told. The actual href, however, points to a near-identical copycat tenant under a different, attacker-controlled Microsoft 365 workspace. But because the destination is still a legitimate sharepoint.com host, the email is less likely to be flagged as a phish.

During its investigation into the ARToken phishing infrastructure, Cisco uncovered the connections to EvilTokens – including an identical API contract to the one originally documented by Sekoia and matching deployment and operational models – as well as “notably more sophisticated” anti-analysis and evasion capabilities.

ARToken’s panel also revealed a very comprehensive post-exploitation toolkit that provides token management and persistence mechanisms, and a built-in business email compromise (BEC) tool with full Microsoft Outlook inbox read access, email sending capabilities as the victim, inbox rule creation for forwarding and deleting messages, and keyword-based monitoring across all compromised accounts.

“These features indicate the platform is more mature than a simple device code phishing kit – it is a complete BEC operations environment,” Kelley wrote. ®

The name OCCT comes from OverClock Checking Tool. This application will let you benchmark and overclock your system components. OCCT is the most popular all-in-one stability check and stress test tool available.

It generates heavy loads on your components while checking for errors, and will detect stability issues faster than anything else. OCCT embeds HwInfo’s monitoring engine to get precise readings and diagnose issues faster.

Can I use OCCT to benchmark my CPU and GPU?

OCCT is primarily a stress test tool used for checking stability issues. With this program you can stress test your CPU, GPU and determine the memory usage on your system. You can configure the app to stop the test when the temperature is too high or when it finds any error so you can prevent hardware failures.

How long does it take to run an OCCT benchmark?

With OCCT you can run stability tests on your hardware from one minute to as long as ten hours. However, it is advisable to stress test your CPU for at least an hour.

What is the new coil whine detection feature in OCCT 15?

OCCT integrates coil whine detection helping users identify electrical noise from their GPU under load. By controlling GPU stress patterns and fan speeds, OCCT can make your card “sing” with distinct tones, making it easier to detect coil whine even in noisy environments. Results vary by GPU model, cooling design, and case acoustics.

Is the new storage test safe for my SSD or HDD?

Yes, but it’s intentionally very demanding. The storage test pushes drives to their thermal and workload limits to verify stability and endurance. While it’s safe for occasional diagnostics, running it too frequently may shorten the lifespan of SSDs or HDDs due to sustained high temperatures and write cycles.

Is OCCT free?

OCCT is free for personal use, but some features such as the Stability Certificate are reserved for paid users. For commercial use there are paid versions that start at $5 per month that include more features such as unlimited time duration.

Features

• Up to 16-core support ( for instance, up to a Quad-Kentsfield or an Octo-Conroe )
• Customizable tests ( Duration, Priority, CPU or RAM, … )
• CPU and Motherboard detection
• Monitoring support through 3rd party application ( i.e. MBM5, Speedfan and Everest Ultimate Edition 3.50 or above )
• Can produce graphs showing temperature and voltages during the test : Unique feature !
• Multi-language support

Don’t let your work go to waste

Ensure your computer is stable before working on your beloved projects – don’t let a reboot or memory corruption put your hard work to waste

Is this a game bug or my computer?

Find out by stress-testing your components. If anything’s wrong, OCCT will pick it up and tell you ! By having a wide-range of test integrated, you’ll be able to pinpoint which one is faulty.

Stop wasting time with after-sale services

Find out which component is faulty and gain time by giving after-sale services proof your hardware is faulty. I don’t promise you it’ll go smooth, but at least, you’ll have backup.

Modern monitoring dashboard

Create easy-to-read, attractive monitoring dashboards showing how your component is behaving in real-time.

Check your cooling

OCCT test will make your components go all out. If anything is wrong with your cooling, you’ll quickly know.

The ultimate CPU test

OCCT’s CPU test gives you full control on which core is tested – Cycle through cores, know which one generated an error, invert them… Lots of fun there.

Squeeze every MHz of your components

OCCT will help you pinpoint ideal values for your overclocked components and ensures rock-stable day-to-day usage.

What’s New

Last month, we introduced one of the biggest evolutions in OCCT’s history: a completely redesigned and fully modular Memory Test.

Today, we’re excited to officially release OCCT v17, bringing together the new Memory Test system alongside a new launcher for OCCT and major optimizations and quality-of-life improvements across the entire application.

This release also comes with new presets for the memory test, including a community-made preset by Stephen Shanks, with even more to come in future releases.

A New Memory Test

OCCT v17 introduces a full redesign of the Memory Test, rebuilt entirely from scratch around a highly modular architecture.

Currently, the new system includes 16 individual testing blocks that can be freely combined to create highly customized memory stress tests. This makes the new OCCT Memory Test one of the most flexible and customizable memory validation solutions available.

Whether you’re validating system stability, investigating intermittent memory issues, or creating specialized test scenarios, the new framework gives you complete control over how memory is stressed and analyzed.

Optimizations and Quality-of-Life Improvements

Alongside the new Memory Test, OCCT v17 delivers major improvements to performance, reliability, and overall usability.

• Faster Startup Time – A brand-new launcher improves startup times by approximately 10% to 30%.
• Lower Memory Usage – Overall memory consumption has been reduced by approximately 15% to 30%, with monitoring data now written directly to disk for improved efficiency during long test sessions.
• Improved Reliability – Better support for portable installations, a reworked auto-update system, and enhanced crash recovery make OCCT more stable and easier to troubleshoot than ever.

Community Presets

• One of the goals behind the new Memory Test architecture is to enable the community to create and share powerful testing scenarios.
• The stable version of V17 launches with 6 presets, including one community-made preset, AM5 Margin Probe by ‘srshanks’.
• Over the coming months, we’ll continue working internally and with the community to identify useful presets that can be integrated directly into OCCT, making advanced testing methods accessible to everyone.
• If you have created a particularly effective memory testing configuration, we encourage you to share it with other users through our Discord server and community channels.

Previous Release Notes:

Adding support for Arrow Lake CPUs

With V16.1, the System Tuning tool now supports Intel Arrow Lake CPUs, including the newly released Arrow Lake Refresh, allowing users to take full advantage of native tuning capabilities directly within OCCT.

System Tuning in v16.1

The System Tuning tool was designed to simplify and unify the CPU tuning process by combining configuration and testing within a single software.

With OCCT V16.1, users can:

• Tune their CPU directly within OCCT
• Run stability tests during the tuning process
• Adjust per-core frequencies (16.6 MHz steps on Arrow Lake)

Work on both Windows and Linux

This approach removes the need for multiple tools while improving the speed and reliability of system stability and overclocking validation.

Continuing to expand support

Expanding hardware compatibility remains a key focus. With Arrow Lake now supported alongside Granite Rapids, we’re already working on bringing the System Tuning feature to more current and previous generations of CPUs.

As always, we welcome your feedback as we continue to improve the System Tuning tool and expand its capabilities.

OCCT 15 Release notes

We’re thrilled to announce that OCCT v15 is now officially out of beta! A big thank you to everyone who helped us test and refine this release over the past few weeks.

This update includes:

• The stable release of our new Storage Test and Benchmark.
• A major 3D Adaptive Test update, with better error detection and a new coil whine detection feature.
• And finally, the long-awaited return of OCCT skins, with LinusTechTips and Corsair kicking things off!

Storage Test and Benchmark Stable Release

• The new Storage Test is now officially stable and available to all users, including OCCT Pro and Enterprise editions. If you missed it during beta, this feature stress-tests your SSDs and HDDs under heavy workloads and high temperatures to validate performance and reliability. However, keep in mind that this test can be very intense for your components and very frequent use can impact your SSD and HDD lifespan, though normal usage poses no significant risk.
• Alongside it, we’re also releasing our new Storage Benchmark. We didn’t try to reinvent the wheel here, instead we aimed to deliver metrics people are familiar with. That’s why we built our benchmark model around CrystalDiskMark-style metrics, providing results that are efficient, comparable, and easy to interpret. It will take us some time still to build the database and give you more meaningful comparative data overtime.
• With these additions, OCCT continues to evolve toward an all-in-one tool that enthusiasts and professionals can use for reliable data without the need for multiple software.

Major 3D Adaptive Test Update

• OCCT v15 isn’t just about storage, it’s also a big leap forward for our GPU test. Our 3D Adaptive test has been made significantly more demanding and precise than before.
• The test works the same as before, but we’ve improved error detection efficiency. Though you might notice lower frequencies or lower power consumption on some GPU’s because the test triggers protection mechanism more aggressively at maximum intensity.
• In short: the new 3D Adaptive test pushes your GPU harder, smarter, and catches issues with greater accuracy.

New Coil Whine Detection Feature

• One of the more experimental and fun addition in v15 is the new Coil Whine Detection feature.
• When working in noisy environments, it can be tough to tell whether a system is producing coil whine. While refining the 3D Adaptive Test, we noticed that in Switch mode GPU fan noise varies depending on load intensity, and thought, “what if we could control that and make the GPU ‘sing’?”
• Turns out, we can! We’re starting with three different tunes, with plans to add more, and maybe even let you create your own in the future.
• It’s important to note that results can vary depending on your GPU model and overall configuration, including factors such as the type of coils used on the board, cooling system, and the case.

New OCCT Skins

• Yes, you read that right, OCCT skins are back! Some of you might remember the Cooler Master skin. Sadly, that one’s gone, but after taking time to rethink how we handle skins and partnerships, we’re thrilled to announce their return in v15.
• You can enable their skins directly from OCCT’s settings or download their dedicated versions from our download page. If you own a Corsair pre-built PC, you may even find OCCT preinstalled and already rocking Corsair colors!
• We have more skins lined up for future release, so stay tuned!

The Clicks Communicator has made its first proper appearance in action. This gives us our clearest look yet at the modern take on the BlackBerry-style smartphone. The planned launch is later this year.

In a newly published demo, Clicks showed a working pre-production version of the Communicator. This revealed how its physical keyboard, custom Android interface and hardware features come together.

While the company has previously teased the device, this is the first time it’s been seen running day-to-day apps and core features. We got the chance to play with a non-working model at CES 2026, and came away impressed.

Russia is putting pressure on Apple with a proposed $52M fine for discriminating against state-backed apps and not having them installed on every iPhone.

On June 25, the Kremlin demanded answers as to why Russian applications made by VK were removed from the App Store. Apple was accused of removing VK apps and services without “warning or explanation,” and Russia threatened to withdraw its cooperation with Apple entirely over the issue.

Now, the country has taken even stricter measures, issuing a warning to Apple, saying the company could face an almost $52 million fine for discriminating against Russian software. Russia’s Federal Antimonopoly Service said Apple devices will need to have the Max messenger and Russian search engines pre-installed.

As noted by Reuters, unless Apple complies with the demands of Russian authorities by July 15, it will face a fine equating to roughly $51.6 million. Even with the threat, though, it’s unlikely Apple will ever include Max or Russian search engines as pre-installed software on iPhones and iPads sold in the country.

Apple hasn’t sold its products in Russia since March 2022, after the Russian invasion of Ukraine. There are no Authorized Apple Resellers in the country, either.

Consequently, every iPhone and iPad sold in Russia makes its way into the country through the grey market. Hardware aside, the App Store remains available on iOS devices in Russia, and Apple has occasionally complied with app-related requests from Russian authorities.

Apple has removed ‘undesirable’ apps in Russia, but it won’t pre-install state software

In July 2024, Apple removed VPN apps from the App Store in Russia. In October 2024 and November 2024, the company similarly removed independent media apps that contained content labeled “undesirable” by Russian authorities.

In February 2023, Apple also paid a $12.12 million antitrust fine for forcing iOS users to rely on its in-app purchase system. After Apple Ireland was fined for breaking sanctions against Russia in March 2026, however, subscriptions and payments for Apple Services are no longer available in Russia.

Despite Apple’s periodic willingness to appease Russian authorities, the two continue to have a strained relationship. In September 2023, Apple warned Russian journalists of state-sponsored spyware, while Russian authorities claimed Apple was helping the United States spy on iPhone users.

Overall, Apple’s only attempts at complying with demands from Russia involve removing apps from the App Store. Beyond that, there’s little the company is seemingly willing to do.

At best, App Store users in Russia might see the return of VK apps. It’s unlikely Apple will develop a region-specific product configuration for Russia, as it does not sell its devices in the country. That ultimately means the state-backed Max app will probably never be preinstalled on iPhones in Russia.

A global memory shortage is pushing Apple to consider alternate RAM suppliers. In all likelihood, this will draw scrutiny from U.S. lawmakers.

The companies in question are ChangXin Memory Technologies Inc. and Yangtze Memory Technologies Co. The companies are on a Department of Defense list of Chinese companies believed to support Beijing’s military.

According to Bloomberg, talks are still ongoing and nothing is final yet. However, Apple’s goal is to reduce the impact of a global memory shortage, which recently caused the company to increase prices across its hardware lineup.

Outgoing CEO Tim Cook, who is set to step down in September, has appealed to the Trump administration, including Treasury Secretary Scott Bessent. Technically, Apple doesn’t need formal approval; the company would likely seek it to avoid any blowback from working with blacklisted entities.

Apple previously attempted to buy Chips from YMTC, specifically for iPhones to be sold in China. At the time, Marco Rubio, the top Republican on the Senate Intelligence Committee, said Apple was “playing with fire.”

Presented by Splunk

Agentic AI is making IT and security teams dramatically more efficient. But it’s also removing the apprenticeship that has long produced experienced operators.

As organizations automate more of the work once performed by junior analysts and engineers, they’re confronting a challenge that’s as much about workforce design as architecture design: how to build the next generation of experts when AI handles the work that once trained them.

What the junior workforce has been doing

For two decades, the path to becoming a world-class SecOps analyst, SRE, or NetOps engineer ran through repetition.

Triaging false positives. Hunting through dashboards for context. Reading logs at 2 a.m. that turned out to be benign. The industry treated this work as drudgery, and in many ways it was.

But it also served as the apprenticeship.

The thousands of hours an analyst spent staring at traffic patterns built the intuition that made them invaluable when a real attack arrived. That intuition was not taught in a single course or captured in a runbook. It was accumulated through exposure, pattern recognition, failure, and escalation. Over time, this is how people earn deep analytical experience.

However, agentic AI is now beginning to automate the very tasks that once served as the training ground for that expertise. That is not a reason to slow down. The drudgery was costly. The burnout was real. Organizations should use agents to reduce toil wherever they can.

At the same time, as we remove that apprenticeship loop, we need to provide operators something better in its place. How organizations approach this issue today will determine the winners for the future.

Organizations that approach this deliberately will produce the operators skilled to succeed in the next decade. Organizations that punt on this may find themselves with faster systems today, but with fewer people who understand them deeply enough to govern them tomorrow.

When automation hollows out accountability

There is also a second dimension to this conversation that gets less attention than it should.

In regulated environments, the drudgery of apprenticeship is part of the accountability layer. Frameworks from SOX to PCI DSS to HIPAA to NIS2 assume there is a chain of human judgments behind a control decision.

Auditors do not interview models. They interview people who can explain why a system did what it did, why the decision was sound, and whether the right controls were in place.

When the population of professionals who can explain that chain begins to thin, the risk may not appear immediately. The control may still pass. The workflow may still be executed. The dashboard may still look green.

But the underlying organizational memory begins to hollow out.

This is not simply a tooling problem. It is also a workforce skill and design problem. And for organizations moving quickly on agentic adoption, the risk is closer than many think.

Building human expertise to govern AI

When we lose part of the accountability layer to agents, humans will step into a different type of governance role. Governing an agentic system means implementing automated guardrails that adapt to non-deterministic agent behavior and ensures agents behave appropriately under conditions no one fully anticipated. It means designing escalation criteria that catch the right anomalies without overwhelming humans with the wrong ones. It means implementing dynamic tools, alerts, and processes to review machine decisions to detect drift, bias, and reasoning failures that no individual case would reveal.

The ability to evaluate and respond to these exceptions requires judgment built over years of experience, learning pattern recognition that the old apprenticeship model used to produce.

That is why the workforce question and the architecture question are now the same question. If we expect humans to govern increasingly autonomous systems, we need intentional pathways that help people manage the scale and speed of AI systems while building the intuition and judgment in human operators required to do that work.

In the AI era, the most valuable platforms will not simply automate the most tasks. They will help people become more capable, more credible, and more essential as the systems around them become faster and more intelligent.

That means organizations need to invest in the full ecosystem of expertise for operators: communities that spread shared practices, certifications or other proofs that make expertise visible, and human-oriented explanations and verifications in the AI along with learning paths that build capability. Empowerment is an architecture design choice

Human empowerment is a critical part of the conversation around the practical use of AI. However, without an intentional strategy to back this up, it risks becoming the kind of phrase that means nothing because it can mean anything.

Empowerment for agentic systems cannot just be a conceptual requirement. It has to be a set of design choices baked into how systems behave. An agentic system that empowers its human operators and grows their professional skillset does four things:

1. Exposes reasoning, with the data lineage behind it

Every recommendation an agent makes should be traceable to the data it considered, the logic it applied, and the provenance of the inputs it used. Operators who can see reasoning develop judgment about when to trust it. Operators handed only conclusions do not.

2. Tiers authority by confidence and impact

Familiar, low-risk patterns can be handled autonomously. Novel situations or actions with meaningful blast radius should escalate by default. The boundary should be explicit and configurable by the teams that own the consequences.

3. Treats disagreements as a correction signal

When an experienced engineer overrides an agent, they are doing more than disagreeing. They are correcting the system with judgment the model did not have: a fragile dependency, a quirk in the environment, a constraint the data never saw. A system that registers the override but ignores the reasoning behind it learns nothing from the one moment a human knew better.

4. Captures resolutions as cross-domain knowledge

How an incident gets resolved is a lesson that rarely stays in one lane. A SecOps incident may expose an ITOps weakness. A network issue may trace back to business impact. When that connection lives only inside a closed ticket, the next team to hit it starts from zero. Resolutions should travel across domains, not die where they were filed.

These are not aspirational qualities. They are testable product capabilities. Leaders evaluating agentic systems should be able to identify where these capabilities live, what happens when they fail, and whether operator skill improves after deployment.

The next advantage is when human and AI scale together

For AI systems to be practical, trusted, and work at scale, the critical design point is for the AI to work deeply alongside and empower human operators.

As such, the agentic era is not a story about replacing humans. It is a story about redesigning the systems humans operate so that these operations can happen at machine speed and scale, while human expertise grows at the same time. Together, rather than at each other’s expense.

That outcome is not a given. It will happen only where leaders treat operator development as a priority, not an afterthought. To achieve this, agentic systems have to be intentionally designed to expose reasoning, capture learning, and route work back to humans in ways that build skill and career rather than erode both.

The agents will keep getting smarter and faster. The ability of operators who work alongside them to learn and grow in lockstep, will determine whether the next decade of digital resilience is something organizations truly own, or something they rent from a shrinking pool of expertise.

Learn more about how Cisco Data Fabric powered by the Splunk Platform is helping teams accelerate agentic operations.

Kamal Hathi is SVP and GM of Splunk, a Cisco Company.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.