Recon Main Blog

Case Study: A County’s Journey from Chasing Alerts to Stopping Threats

Recon Team — Wed, 10 Jun 2026 04:36:31 GMT

Lean Team, Big Responsibility

A mid-sized Texas county government was managing its entire technology operation with a lean IT team who were responsible for everything from daily work orders and access control to security camera networks and call management. When a new IT Director stepped into his role, cybersecurity had never had a dedicated owner. That was about to change.

Cross-Org Visibility for LimaCharlie

Ben Webb — Wed, 03 Jun 2026 04:48:36 GMT

At Recon InfoSec we run many aspects of our security operations on LimaCharlie. It's an API-first EDR platform that gives us total control over how we build and run our security stack. We can deploy sensors across any environment, and from there we have complete flexibility. We bring in telemetry from virtually any source and process it at wire speed with detection and response actions that we write and tune, plus we have infinite knobs and dials to adjust everything from what telemetry we’re surfacing, to how it is transformed through the system, and what we finally pass on for post processing. Instead of working around a vendor's assumptions about how security operations should look, we build the exact platform we need to best serve our customers.

What's Actually Hitting Organizations Right Now: ClickFix, Identity Compromise, and AI-Powered Risk

acook@reconinfosec.com (Andrew Cook) — Fri, 08 May 2026 20:31:59 GMT

Every day at Recon InfoSec we’re thinking about one thing: how are we giving bad guys headaches? To do that well, you have to stay close to what those bad guys are actually doing. So let me share what we're seeing in the field right now, because some of it is more creative than some people realize.

Iranian Government Affiliated Intrusions: Documented Tradecraft

luke@reconinfosec.com (Luke Rusten) — Tue, 03 Mar 2026 18:48:12 GMT

When geopolitical tensions rise, defenders tend to ask the same question: What does Iranian cyber activity actually look like on the wire?

ClawHype: Making Sense of Recent AI Cybersecurity News

Nicholas Lupien — Fri, 06 Feb 2026 00:09:37 GMT

Editor note: The sudden rise and crash of OpenClaw and Moltbook have been wild. The media will move on, but the story isn’t over for IT teams dealing with the risks posed by unauthorized AI. In this Q&A, Nick Lupien (Head of Recon Labs) will help make sense of the recent news and offer broader AI governance advice.

What would an IT manager need to know about the OpenClaw and Moltbook security issues? What makes these security issues different from others?

At this stage, it’s probably best to treat OpenClaw (formerly Moltbot, formerly Clawdbot) like malware. In order for OpenClaw to perform its stated function (a local personal assistant), it requires significant access to private data, arbitrary code execution privileges, and absolute autonomy without human approval. This combination is dangerous even without AI, but it’s particularly concerning when you consider that AI is vulnerable to prompt injection (other people trying to trick your agent into acting against your best interests) and misalignment (the model underneath providing inaccurate data and suggestions).

These are both “forever problems” with large language models, and they’re the reason we put “humans in the loop” for critical functions like sending emails or texts or executing code in privileged contexts. When you hand the keys over to an agent that will automatically act on your behalf, you’re taking immeasurable risk with not only your data, but that of everyone you interact with. It’s like turning on full car automation on untested infrastructure and then going to sleep. It raises serious concerns.

Moltbook is a public “Reddit-like” social media site that OpenClaw agents interact with autonomously. There have already been reports of massive data loss due to an improperly configured database. Though this and other vulnerabilities have been addressed, it’s the clearest example yet of the threats posed by OpenClaw, and it’s likely not the last.

Employees have always used unauthorized apps at work. How is that problem different now with AI tools?

Unauthorized/unvetted apps are still a big problem and contribute to significant losses for companies every year. The type of risk is the same: loss of confidentiality and integrity when the application misbehaves, whether through malicious activity or accidental misuse. The addition of AI significantly increases the magnitude of the threat: they are more likely to be exploited, and the effects of misuse are significantly more damaging to you, your organization, and everyone you interact with.

How do I decide whether to allow AI tools at our company? What safety measures must I put in place to protect our data and systems?

Stepping back, I wouldn’t conflate OpenClaw with most “AI tools.” There are many AI tools like Claude, Gemini, and ChatGPT that have mechanisms to control human-in-the-loop and that encourage good security practices. The best safety measures we’ve seen are proactive ones: provide people with vetted tools, and train them on best practices for interacting with confidential data. All of the large providers have a “no training on customer data” option for paid subscribers, and some have zero data retention policies available. Research and understand these features before deciding on a platform. Search for “Trust Center” with the products you’re considering to fully understand their compliance environments. For enterprise deployments, look for features like audit logs, admin controls, and SSO integration.

Deciding whether to allow AI tools at your company is a risk/benefit discussion. The risks of a trained workforce using vetted tools can be controlled but are never completely mitigated. Apps change quickly, and new features may introduce new risks that require significant, ongoing attention. If you decide to embrace AI, commit to one or two products at first, and create a plan to keep up with changes to those products. Even vetted tools require good policy around integrations and human approvals.

If employees are already using unauthorized AI tools, how do I find out and what should I do about it?

Prevention is really the first step. Decide on a path that satisfies employee and company needs, create a policy, communicate it, and enforce it.

Surveying / Enforcing: if you have a managed security provider or security operations center, have a conversation with them about detecting unauthorized software installations or visits to unauthorized sites. They will have a number of tools at their disposal to detect and surface unauthorized use.

What are the most important security rules IT leaders should follow when dealing with AI? What security basics stay the same even as technology changes?

Never grant an AI agent “modify” or “execute” permissions against a system that processes confidential data without a human approver.

The concept of “least privilege” underscores this entire conversation. Would you allow an intern to commit code to your production codebase without a senior engineer’s review and approval? Would you allow them to send emails to the CEOs of your customers without reviewing or approving them? Least privilege isn’t new, but people placing total trust in LLM agents is. Generally, you can’t have both.

Where can IT managers go to keep learning about AI security threats and how to handle them?

The Center for AI Safety (https://safe.ai/) is a non-profit dedicated to reducing societal-scale risk from AI. Their newsletter addresses current events pertaining to AI risk, including cyber risks.

Anthropic Academy has several great courses around AI fluency and technical expertise: https://anthropic.skilljar.com/

As always, monitor vendor security advisories and CVE databases for AI-related vulnerabilities.

What's one thing an IT manager can do this week to immediately improve AI security?

Create a policy that provides a governable path to individuals using AI safely and responsibly, and commit to supporting and enforcing it.

Planning for the Worst: Making IR, BC, and DR Plans Work

mthompson@reconinfosec.com (Macie Thompson) — Fri, 09 Jan 2026 17:32:15 GMT

Organizations know they should have plans for cyber incidents, but too often those plans are outdated, incomplete, or untested. Incident Response (IR), Business Continuity Plans (BCP), and Disaster Recovery (DR) plans are frequently treated as check-the-box documents instead of living, operational playbooks. The real cost of that mindset becomes painfully clear during a major cyber incident.

Case Study: From Running Blind to Active Defense

Recon Team — Thu, 04 Dec 2025 19:44:26 GMT

How a Mid-Size Energy Infrastructure Company Achieved 95%+ Security Score and Peace of Mind

A Pragmatic Approach to Vulnerability Management

Ben Webb — Mon, 10 Nov 2025 13:23:04 GMT

Every Pentest Makes us Better

acook@reconinfosec.com (Andrew Cook) — Wed, 08 Oct 2025 18:06:26 GMT

Penetration tests reveal the true strength of your organization’s security posture. Approached correctly, they also serve an important role in continuously improving your ability to find and stop real threats quickly. At Recon InfoSec, we view our customers’ penetration tests as invaluable opportunities to test and improve our detection capabilities against skilled attackers in a controlled environment.

Delivering AI Superpowers to Security Teams: Introducing Recon Labs

Nicholas Lupien — Mon, 22 Sep 2025 21:39:15 GMT

Recon InfoSec, a leader in managed security operations, is proud to announce the creation of Recon Labs, our internal R&D organization that delivers superpowers to your security teams.