Outcomes Over Alert Queues: Rebuilding MDR Around Speed

Almost everything that matters in security operations happens in the gap of time between detection and response. For most managed detection and response (MDR) providers, the gap is governed by human analyst capacity.

For years, the standard answer to threat velocity has been to hire more people. But a service built on human analysts reviewing alerts, running manual or semi-automated playbooks, and passing tickets back to the customer has a built-in bottleneck. Adding headcount widens the alert queue without changing its nature or actually solving the problem.

Attacks that execute in seconds don’t wait for a shift change. Not to mention more people means higher MDR prices that customers have to bear. Something has to give.

Coalition acquired Wirespeed for its ability to stop cyber threats in milliseconds. Now, the market is demanding the very things we do best: robust detections, near-instant investigations that lead to clear verdicts, and threat containment instead of escalations.

Coalition was recognized in The Managed Detection And Response Services Landscape, Q3 2026 report by Forrester Research Inc.

A Changing Landscape for Security Operations

Organizations of all sizes have security stacks fragmented across endpoint, cloud, identity, SaaS, and operational technology (OT) with attack surfaces that have been growing faster than any security team can hire against. These are the compelling reasons why organizations look to third-party MDR services to keep their heads above water.

With a fragmented market of MDR providers, further impacted by the adoption of AI, the basis of comparing vendors has moved. Multivendor telemetry, 24/7 coverage, and case management have long been table stakes, but they’re not enough.

Verifiable security outcomes were a longstanding objective for customers evaluating MDR services. That’s one reason the market adopted “MDR” over “MSSP” many years ago. What separates MDR providers now is how far automation is allowed to go.

With a fragmented market of MDR providers, further impacted by the adoption of AI, the basis of comparing vendors has moved.

Where Speed Actually Matters

Wirespeed addresses managed SIEM and log management, OT and IoT detection and response, and security posture improvement. Beyond these capabilities, Wirespeed serves the full set of scenarios that MDR buyers most often seek.

In fact, Wirespeed was built from the ground up to be a fully automated, deterministic-first AI-SOC, with human oversight only for escalated cases.

Managed SIEM & Log Management

Anyone who has used an MDR provider or two knows that there's a great deal of variability in what “managed SIEM” actually means. Smaller, boutique providers may invest heavily in a customer’s existing SIEM deployment, but that comes at the cost of scaling service delivery across dozens of customers. Their inability to scale affects their margins, which, in turn, can create pressure to cut back on service quality to make up for it. Large scale MDR providers often take the opposite approach and can force you into their managed platform, where you may get less control and less value out of your current security investments, whether you like it or not.

Wirespeed syncs your detection rules and uses AI to categorize them to our taxonomy, so we can provide full investigations in milliseconds when they fire an alert.

Wirespeed strikes a great balance. We ship with our own built-in SIEM, 85+ integrations that connect quickly with nothing on-prem, and include both our own managed detection rules and the ability for you to write your own rules in natural language with AI. And we also support the major SIEM platforms organizations already own and love: We sync your detection rules and use AI to categorize them to our taxonomy, so we can provide full investigations in milliseconds when they fire an alert.

AI Detection & Response

Many MDR providers have bolted on AI to assist with investigation, but that’s very different from letting a machine act without a person in the critical path — the latter is what buyers are often uncomfortable with. AI assistance alone isn’t achieving the fastest possible threat containment times because it still requires a queue of detections for humans to review.

With Wirespeed, alert noise falls 99.99% before anything reaches your queue.

Wirespeed is deterministic-first, running telemetry to detections to automated investigation to verdict to response, with expert humans supervising through statistical sampling under Acceptable Quality Limits (ISO 2859) rather than approving each case. That's how our 0.000067% critical defect rate gets measured rather than asserted, and why verdicts and remediation land in milliseconds on actions the customer pre-authorized.

With Wirespeed, alert noise falls 99.99% before anything reaches your queue, and investigation always stays unmetered: no consumption pricing, no AI token burn.

OT/IoT Detection & Response

Invasive agents may not run on a legacy PLC, and a broad kill command across a medical device network or a SCADA environment could turn a security incident into a physical safety disaster. MDR providers typically struggle to learn their customers’ environments; configuration management databases are often incomplete, and human analysts are under too much time pressure to pause and figure out if an alert is coming from an OT device.

Wirespeed contains threats on IT systems while leveraging OT/IoT asset data to carefully and rapidly escalate to your in-house experts for special handling.

Wirespeed counters this problem by integrating with your asset management systems. We pull asset tags from Entra, your EDR, your attack surface, and vulnerability management tools (like Axonius), so our deterministic-first verdicts can handle critical assets with due care. Wirespeed contains threats on IT systems while leveraging OT/IoT asset data to carefully and rapidly escalate to your in-house experts for special handling. We also integrate with innovative detection products, like Sandfly, that run agentlessly for critical OT systems when agents on devices are a business risk.

From drilling rigs to research lab equipment to pharmaceutical manufacturing systems, the question worth putting forth to any MDR provider is how they can confidently state they can monitor environments with a mix of IT and OT/IoT systems without simply escalating everything.

Exposure Management

Detection describes what is happening; exposure describes what could happen. Usually, the two are bought from separate vendors.

Coalition acquired Binary Edge to make attack surface management a core component to both our insurance underwriting and our ongoing assistance to policyholders. Our Active Data Graph combines our own scanning engine with intelligence from incidents across the globe, not to just let you know what could theoretically become a material impact breach, but what is most likely to become material. (We also offer this service for third-party risk management of your suppliers, as well.)

Security Posture Improvement

Most vendors handle a case by launching a ticket with a recommendation over the fence, which hands the work back to the customer at the moment it matters most.

Data from security scans and incidents across the globe feeds back into both the accuracy of Wirespeed's investigations and the posture recommendations that come along with them.

Wirespeed executes the remediation steps instead, through response actions you approve in advance, and leaves a record of what happened so you can review afterward. Patterns of behavior come with posture recommendations, and you can choose to enforce stricter security hygiene in your organization, like not allowing the use of privacy VPNs or residential proxies to log into corporate systems, by overriding our verdict settings.

Data from security scans and incidents across the globe feeds back into both the accuracy of Wirespeed's investigations and the posture recommendations that come along with them.

Why We Built Wirespeed

Legacy MDR broke down because it assigned human analysts with the stress of an air traffic controller landing thousands of planes per hour. The result is delays, inconsistent handling of investigations, unverified tickets, and customer escalations without immediate containment actions — all while attacks unfold in seconds.

Wirespeed inverts the order. Applying deterministic-first execution within pre-authorized guardrails, Wirespeed gathers evidence, logs every decision step, reaches a verdict and contains the threat in milliseconds, and delivers investigations the customer can audit afterward.

In an era of machine-speed attacks, the distance between a verdict and a response is the whole contest. Wirespeed closes it in milliseconds.

LIGHTNING-FAST SPEED. LASER PRECISION.

Wirespeed Automated Detection & Response

Start your free 30-day trial >

Two Citrix RCE Zero Days Exploited in the Wild

On September 26, Coalition alerted at-risk policyholders to two Citrix NetScaler zero-day vulnerabilities following unconfirmed reports of active exploitation from reliable sources.

At the time of our Zero-Day Alert, Citrix had not publicly acknowledged the vulnerabilities. We observed increased scanning for NetScaler assets on Coalition honeypots, which may indicate threat actors are preparing for or running attacks. As a result, we recommended that policyholders disconnect devices from the internet if possible, restrict access if not possible to disconnect, and patch once it became available.

On September 27, Citrix officially published a security bulletin confirming the vulnerabilities and released patches for the impacted NetScaler appliances. We have since followed up with affected policyholders to provide additional remediation guidance.

What’s happening?

Citrix confirmed that exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments were observed in the wild.

- CVE-2026-88771 is a critical remote code execution (RCE) vulnerability that can allow an unauthenticated attacker to execute arbitrary commands.

- CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or a denial-of-service condition.

The patch also addressed six other flaws. NetScaler is a popular target for cyber criminals because it provides remote access to internal applications and desktops and is often exposed directly to the internet. NetScaler is widely used by enterprises across all industries, further supporting how lucrative these zero days can be for attackers.

Given the severe consequences of successful exploitation, immediate action is necessary. Before Citrix publicly acknowledged the vulnerabilities, IT suppliers, security researchers, and the Dutch National Cyber Security Center had already begun its own outreach to potentially impacted organizations. Security teams then flocked to Reddit, awaiting additional information or confirmation from Citrix.

Not a “Secure by Design” response

In 2025, Citrix signed CISA’s Secure by Design pledge, committing to seven measurable product-security goals alongside hundreds of other vendors. The premise is simple: when a vulnerability emerges, vendors should disclose it quickly, share what they know about active exploitation, and give customers actionable guidance — even before a patch is ready.

On these two zero days, Citrix’s public communications lagged the initial reports by at least 36 hours, based on our timeline.

In today’s threat environment, 36 hours is an eternity. During that window, customers had neither clear guidance nor a confirmed scope of impact. They didn’t have acknowledgement of new vulnerabilities at all and Citrix customers were left to fend for themselves.

The disconnect between a public commitment and what customers experience in practice matters more today than ever. AI is compressing the window between discovery and mass exploitation, so response timelines that once seemed merely slow are becoming materially riskier. The end user still bears much of the responsibility for securing the technology they buy, despite being the party least equipped to do so.

On these two zero days, Citrix’s public communications lagged the initial reports by at least 36 hours, based on our timeline.

When a zero day lands and guidance is slow, customers are left treading water with both hands tied, unsure how deep the water is or how long they’ll be treading.

This is why Active Insurance exists. Wherever gaps in vendor response appear, someone needs to sit on the policyholder’s side of the table: monitoring threats, translating them into plain language, and helping customers respond quickly. Security cannot stop at the vendor’s product team; it must extend to the customers who rely on that product when the stakes are highest.

How should businesses address this?

The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities:

- Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37

- Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23

- Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS

- Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279

Organizations running any of the above versions of NetScaler ADC and NetScaler Gateway should install the relevant updated versions as soon as possible, as vulnerabilities are being actively exploited. Those that cannot immediately patch should limit exposure to the internet until they can patch.

More detailed guidance for remediation can be found in Citrix’s security bulletin, including details on all eight vulnerabilities and steps to determine if an appliance meets the CVE preconditions. Citrix has also made generic Indicators of Compromise available through NetScaler Console to help customers determine if their NetScaler deployments have been affected.

Who’s at risk?

Enterprises rely on Citrix NetScaler worldwide to manage traffic and authentication. Given the nature of both zero days (each with a 9.5 severity score), cybersecurity agencies in the UK, US, and the Netherlands all released advisories confirming the vulnerabilities.

Citrix Bleed One and Citrix Bleed Two, prior NetScaler zero days, led to high-profile breaches impacting critical infrastructure, healthcare entities, and major companies.

How Coalition is responding

Following our initial outreach on September 26, we have followed up with policyholders to ensure that they are aware a patch is available, both through email and in some cases, ongoing direct phone calls.

For assistance with mitigation, contact Coalition’s Security Support Center at securitysupport@coalitioninc.com.

SPOT & STOP CYBER THREATS

Coalition Control

Take control of your cyber risk >

How Wirespeed Enhances Investigations With SIEM Upgrade

In the last 90 days, Wirespeed has escalated only 2,294 of 8.1 million detections to our customers. This directly translates to less tedious alerts for users and more time to focus on strategic initiatives.

Wirespeed’s automated protection is designed to empower security teams, not replace them. Over the last quarter, we’ve launched new integrations, features, and product updates all designed to enhance your team’s capabilities, support your investigations, and reduce the noise. You’ll find:

- 15 new integrations to connect more of your security stack to Wirespeed

- Managed Detections, fueled by global risk intelligence, to help catch evasive threats

- More data at your fingertips to prove Wirespeed’s ROI to decision-makers

- And more!

New integrations

Wirespeed connects to your existing security tools to provide automated threat detection, investigation, and response. Our integrations are designed to work together by combining detection sources with user directories, endpoint managers, and communication platforms to enable automated protection.

Below, we’re highlighting the new integrations from the past quarter that may be most impactful for our users:

Network & Perimeter Security

- Ubiquiti UniFi: Monitors physical and perimeter network infrastructure, capturing syslog telemetry from gateways and access points.

Email & Workspace Security

- Perception Point / FortiMail: Inspects messaging and cloud collaboration channels for phishing, malware, and social engineering attacks.

Endpoint Security & Management

- Agger Labs: Focuses on host-level protection against ransomware and process tampering.

- Acronis: Merges endpoint data backup with cyber protection to secure local and cloud-based data assets.

- Fleet: Uses Osquery to maintain real-time visibility over device fleets, software inventories, and host states.

Identity & Access Management (PAM / EPM)

- Admin By Request: Removes permanent local admin rights, allowing users to request time-limited, audited privilege elevation.

Security Service Edge (SSE) & Zero Trust

- Netskope: Controls access to SaaS applications and internal network resources using Cloud Access Security Broker (CASB), Zero Trust Network Architecture (ZTNA), and web security policies.

Deception & Intrusion Detection

- Tracebit: Uses decoy cloud infrastructure to catch unauthorized lateral movement and adversary probing with high-confidence alerts.

Vulnerability & Exposure Management

- Tenable Nessus (Attack Simulation): Scans infrastructure to surface active vulnerabilities and simulate threat vectors across the attack surface.

IT Operations & Service Management (ITSM)

- Freshservice: Streamlines service requests, IT asset tracking, and automated incident creation based on security alerts.

Learn more about all available integrations and how to connect your security stack.

Product updates

We are constantly implementing updates and new features to the Wirespeed platform.

Over the last quarter, we revisited our security information and event management (SIEM) architecture — one of the foundations of Wirespeed. We updated it to prepare for the future and give your security team more autonomy. In addition, we’re putting more data directly in your hands so you can prove Wirespeed’s ROI with ease.

Enhanced SIEM Architecture

We have enhanced Wirespeed’s SIEM platform to improve overall user experience. Logs are now stored in their native format rather than the previous Open Cybersecurity Schema Framework (OCSF).

How does this directly improve your Wirespeed experience?

- Speed: You can query logs 80-100 times faster than before.

- Ease: Logs are now organized by source, enabling Wirespeed AI to better identify the root cause behind an incident.

- Proactive: An updated SIEM allows for further automated verdicts informed by Coalition-native threat intelligence.

Managed Detections

Managed Detections work on top of existing third-party integrations to help catch evasive threats that traditional security tools can overlook.

Managed Detections are powered by insights from over 1 billion daily events, data from security scans and incidents across the globe, and threat intelligence provided by Coalition Incident Response (CIR)*. In addition to traditional signs of malicious activity, such as suspicious logins or unlikely travel, Wirespeed monitors for novel or unconventional indicators of attack directly informed by real-life scenarios.

For example, following the rise of device code phishing, which abuses the OAuth 2.0 Device Authentication functionality, Wirespeed began to monitor for successful device-code authentication followed by multiple logins for the same user. Whereas traditional tools can miss the abuse of Microsoft’s OAuth feature because the logins look legitimate, Wirespeed recognizes it as suspicious behavior and can act automatically to contain attackers.

We are constantly expanding our library of Managed Detections. The team continues to track the latest threat intelligence data to parse into automated rules that function across all client environments.

User Identity Patterns

You can now use Wirespeed’s activity baseline data in your own investigations.

Wirespeed tracks what “normal” behavior is for your users across multiple sources, such as where they work from, when they work, and which devices they use. This activity informs their predictable, baseline activity. This information is how Wirespeed knows to act when users stray from their usual behavior patterns, like unlikely travel.

We recognize that this information can be useful for your team to complete its own investigations as well, especially if Wirespeed augments your security capabilities. To access individual user baseline data, go to Users and select an individual to see Day & Time Login Patterns, User Agents, Logins by Browser, and more.

Impact & ROI Widget

One of the biggest challenges that security leaders face is translating technical defense into business terms. How do you prove to decision-makers that the tools you have (or need) move the needle on risk reduction?

You should always know exactly how Wirespeed delivers for you and your team, and clearly be able to show that value to others. Along with the new visibility of User Identity Patterns, where you can see our work, we also have an Impact & ROI Widget designed to highlight how Wirespeed’s automation-fueled noise reduction saves time and labor costs.

You can toggle seamlessly between Time Saved (hours) and Financial Value (dollars) across rolling 90-day windows. Estimates are informed by SOC industry standards of the average hourly cost of analyst labor ($50) with the average manual triage time (20-minutes). The operational impact is informed by personalized Wirespeed data for your organization, by subtracting the analyst time spent on escalated reviews from total automated triage hours and cost.

You can find the Impact & ROI Widget, along with other high-level statistics, in Team Analytics.

We’re here to enhance your team

Wirespeed is always improving to adapt to new threats, meet the needs of different security teams, and provide the best possible protection.

While you focus on the bigger picture, we monitor user behavior, track threat intelligence feeds, and implement new features to make your investigations go smoother.

MILLISECONDS-FAST. DETERMINISTIC-FIRST.

Wirespeed AI SOC

See how Wirespeed stops threats in milliseconds >

Combatting the ‘Vulnpocalypse’ With Zero-Day Alerts

Warnings of the “vulnpocalypse” are crowding conference presentations, headlines, and conversations among security professionals. Are the end times near?

AI is enabling attackers to find and exploit more vulnerabilities than before. We’ve felt it as the number of Zero-Day Alerts (ZDAs) sent each quarter has trended upward — with a distinct surge in 2026. The volume may be unprecedented, but the solution is straightforward: Know where to focus.

That’s exactly what our ZDAs help policyholders accomplish. Despite the growing number of vulnerabilities, the majority of policyholders still don’t receive a single notification. The vulnerability surge is manageable as long as security teams spend less time focused on hundreds of supposed “critical” risks that are unlikely to be exploited, and instead spend more time remediating actual threats.

ZDA Snapshot

- Coalition sent 49 ZDAs between May 1, 2026, and August 1, 2026

- 94% of policyholders didn’t receive a single ZDA

- 59% of notified policyholders have fewer than 25 employees

Below, we’ll explore how we’re helping policyholders navigate record-breaking vulnerability volume and which businesses are most likely to receive ZDAs.

Helping policyholders navigate record-breaking Patch Tuesdays

The pressure is on both vendors and security teams to find issues before attackers can abuse them. In July, Windows shared that it would apply AI across security analysis to find vulnerabilities earlier and at greater scale.

This likely contributed to the record-breaking Patch Tuesday in June with 206 vulnerabilities. In July, the number nearly tripled to 569. Prior to the adoption of multi-model AI for vulnerability discovery, Microsoft typically shipped around 100 fixes each month.

As soon as the vulnerabilities are disclosed, the clock starts ticking for organizations to act. Earlier this year, Anthropic disclosed that Mythos could create working exploits for newly discovered vulnerabilities in hours, as opposed to weeks. For security teams, this translates to an unprecedented volume of alerts every month to parse through and less time to do it.

Straightforward prioritization with ZDAs

Of all the vulnerabilities addressed in Microsoft’s July Patch Tuesday, roughly 60 were rated critical. More than 500 were rated important. Coalition continues to narrow the focus to which flaws we believe are most critical from an external exposure standpoint. In July, we sent two ZDAs on the same day as Patch Tuesday:

- SharePoint

- CVE-2026-56164 was added to CISA KEV on the same day as publishing and exploited as a true zero-day. With a Common Vulnerability Scoring System (CVSS) score of 5.4, it’s not particularly alarming on its own. But our analysis found that the nature of the vulnerability could make it an entry-point for other, more severe vulnerabilities. Subsequently, NVD enrichment gave it a 9.8 critical rating.

- CVE-2026-58644 was added to CISA KEV two days later. It’s a remote code execution (RCE) vulnerability that requires Site Owner privileges, which CVE-2026-56164 grants.

- CVE-2026-50522 is a standalone RCE that permits an unauthorized attacker to execute code over a network.

- Windows Message Queueing

- CVE-2026-50447 is a heap-based buffer overflow in Windows Message Queuing that allows unauthorized attackers to execute code over a network.

The expectation is not that policyholders will neglect the rest of the Patch Tuesday release, but that those at high-risk due to the above vulnerabilities will know where to start to dramatically reduce their exposure. Coalition continues to monitor and alert policyholders to the most critical risk following Patch Tuesday releases.

When evaluating what made the cut (among the 569 vulnerabilities), we found that many of the flaws weren’t noteworthy on their own or didn’t carry a particularly high CVSS score. The forest mattered more than the trees. Take, for example, CVE-2026-56164, a vulnerability that is low-risk on its own but an avenue for RCE when chained with CVE-2026-58644.

Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow.

We saw the similar impact of chained vulnerabilities with WP2Shell (more on that below). Chaining vulnerabilities was once labor intensive for attackers, but AI agents allow for an entirely automated workflow. As Microsoft accounts for entire attack chains, it’s likely that the total volume of fixes will continue to swell.

59% of policyholders that received a ZDA have fewer than 25 employees

Employee count

Of all policyholders that received a ZDA, 59% had fewer than 25 employees.

For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Small and midsize businesses (SMBs) are typically the most strapped for resources and time, which often means they lack vulnerability management processes. For well-intentioned SMBs, a Patch Tuesday with nearly 600 vulnerabilities could present a month-long challenge.

Coalition sends ZDAs with clear steps for remediation to make patching as straightforward as possible. ZDAs are meant to supplement, not replace, a policyholder’s own patching and vulnerability management practices. While we can’t control how AI is shaping the volume of threats, we can make risk mitigation accessible for even the smallest businesses.

ZDAs per policyholder

The majority of policyholders (94%) did not receive a single ZDA from us. Of those that did, 91% received just one.

While the “vulnpocalypse” introduces an overwhelming number of vulnerabilities, the majority have no confirmed exploitation. Between 2018 and 2025, the share of newly published CVEs with confirmed exploitation remained below 2.2%, even as annual CVE volume grew 2.5 times.

Businesses that try to patch everything at once risk being overwhelmed. When we send ZDAs, we consider business impact and the legitimate risk of exploitation. The intention is to cut through the noise and guide businesses to focus on the same small percentage of risks that adversaries do.

ZDAs by industry

We observed a reasonably balanced dispersion of ZDAs sent across sectors. This is to be expected, as no industry is immune from the risk of aggregation events or vulnerable software.

Staying ahead of threats in the AI era

Autonomous discovery tools have fundamentally changed how security teams respond to critical threats. Moving fast isn't enough; defenders must evaluate vulnerabilities holistically based on potential financial loss. While traditional CVSS scores offer a baseline, they don't directly translate to real-world business impact.

Coalition delivers timely, prioritized ZDAs straight to policyholders’ inboxes when data indicates a vulnerability threatens their bottom line. Along with step-by-step remediation guidance, policyholders can access third-party risk management and attack surface monitoring through Coalition Control®, our cyber risk management platform.

EASILY SPOT & STOP CYBER THREATS IN ONE PLACE

Coalition Control

Take control of your cyber risk >

ConnectWise Investigating Unauthorized Access to Cloud Backup App

ConnectWise is investigating attempts of unauthorized access tied to its Cloud Backup for Microsoft 365 service (formerly known as SkyKick Cloud Backup). The company disclosed the incident on October 16, noting that containment measures were in place and that it had no indication that partner backup data was accessed.

Based on early community reports, security teams across Coalition and Wirespeed began investigating the incident prior to the disclosure. Coalition identified policyholders using adjacent ConnectWise SaaS technology, while Wirespeed identified its customers with the backup application in their Microsoft 365 tenants.

Immediately, we orchestrated outreach to begin notifying all impacted parties.

What ConnectWise has confirmed

ConnectWise disclosed the incident on October 16, noting that it initiated incident response procedures, has containment measures in place, and has no indication that partner backup data was accessed. The investigation is ongoing.

Separate public reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to access customer tenants and exfiltrate email, SharePoint, and Teams data. ConnectWise has not confirmed these reports.

ConnectWise published the following indicators associated with the suspicious authentication activity. ConnectWise notes their presence alone does not confirm compromise.

- Source IP: 144.172.64.128

- User agents: Python-urllib/3.12 and python-requests/2.31

The application appears in Microsoft Entra as "SkyKick Backup" or "ConnectWise Cloud Backup," with App ID 506e08f9-6e9a-4da4-942b-a099a03644ae.

Why backup applications carry elevated risk

Cloud backup services for Microsoft 365 connect through a Microsoft Entra application that an administrator approves with tenant-wide permissions. The application then accesses data on its own, without a user sign-in, password, or MFA prompt. This is required for unattended backups.

Those permissions extend to anyone who can authenticate as the application. If its credentials are compromised, access is possible in every tenant that approved it, at the level the backup service already holds, typically read access to mail, SharePoint, and Teams.

This activity can be difficult to detect. Bulk reads of mailboxes and files are normal for a backup service, and user-focused controls such as MFA do not apply to application sign-ins. Because MSPs often deploy one backup vendor across many clients, a single vendor incident can affect a large number of organizations.

Recommended actions

The following steps apply to organizations that use ConnectWise Cloud Backup (SkyKick) for Microsoft 365, directly or through an MSP. The presence of the application in a tenant confirms the organization is a customer. It does not indicate compromise.

1. Disable the application

In Microsoft Entra, open Enterprise applications and locate "SkyKick Backup" or "ConnectWise Cloud Backup," or search by App ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Under Manage → Properties, set "Enabled for users to sign-in" to No. Backups will stop while the application is disabled. Re-enable it after ConnectWise confirms remediation.

2. Search for the indicators

Review Entra sign-in logs and the Microsoft 365 unified audit log for activity tied to the App ID, IP 144.172.64.128, or the user agents Python-urllib/3.12 and python-requests/2.31.

3. Review access volume

Investigate unusual bulk access to mailboxes, SharePoint, or Teams, particularly outside the backup service's normal schedule.

4. Preserve logs

Export the relevant sign-in and audit logs. Default retention periods may be shorter than an investigation requires.

5. Report suspicious activity

Coalition policyholders who find activity matching these indicators should contact Coalition.

How Coalition and Wirespeed are responding

Coalition sent a Zero-Day Alert to policyholders who expose ConnectWise SaaS usage. Coalition cannot determine from external data which of those organizations use the backup service, so the alert was precautionary and included steps for each recipient to check.

Based on early community reports, security teams across Coalition and Wirespeed began investigating the incident prior to the disclosure.

Wirespeed's visibility into the Microsoft 365 tenants it monitors allows it to identify which customers use the backup service and whether the known attacker activity appears in their environments. All Wirespeed customers using the service have been notified.

Next steps

Coalition and Wirespeed will continue monitoring and will update guidance when ConnectWise confirms remediation. Policyholders who find activity matching the indicators above should contact Coalition.

Wirespeed has launched new Managed Detections to alert on any malicious activity related to the ConnectWise Cloud Backup for Microsoft 365 to help ensure the platform responds automatically. Organizations should also review which third-party applications have access to their Microsoft 365 tenant, including those connected by an MSP, under Enterprise applications in Microsoft Entra.

Weekly highlights

Ocean rates – Freightos Baltic Index

- Asia-US West Coast prices (FBX01 Weekly) increased 2%.

- Asia-US East Coast prices (FBX03 Weekly) increased 2%.

- Asia-N. Europe prices (FBX11 Weekly) decreased 1%.

- Asia-Mediterranean prices (FBX13 Weekly) decreased 4%.

Air rates – Freightos Air Index

- China – N. America weekly prices decreased 7%.

- China – N. Europe weekly prices increased 1%.

- N. Europe – N. America weekly prices stayed level.

Analysis

The increasingly cold war in the Strait of Hormuz – including reported progress in an Iran-Oman authority-sharing agreement – heated up a little recently. Alongside more Iranian strikes on vessels and US claims of demining progress, the US hit Iranian rocket launchers possibly dedicated to deploying more mines and Iran responded by targeting US sites in Jordan.

Transpacific ocean rates ticked up by 2% last week to new peak season highs for both coasts as volume strength has stretched on through August despite the early start to peak season demand back in late May.

Prices passed the $7,600/FEU mark for the West Coast and climbed to about $9,800/FEU to the East Coast. Carriers are increasing capacity slightly for September in anticipation of still-elevated volumes – with more rate increases, especially for the East Coast, possible to start the month – up until October’s Golden Week, with blanked sailings set for the holiday period. Though there is no clear explanation for the surprisingly resilient demand, the absence of tariff hikes in late July and an increase in data center hardware volumes may both be contributing. Tariff refunds that are enabling some retailers to reduce prices may also be spurring some retailers to increase inventories.

Coming Panama Canal, low water restrictions have some carriers planning surcharges for transiting containers in September, which could add pressure on some East Coast rates soon.

Another likely contributor to elevated transpacific container rates is the unrelenting congestion in major Far East hubs from the succession of typhoons that have hit the region since mid-July. The latest, Typhoon Saudel, closed ports including Shanghai and Ningbo for several days last week, disrupted operations as far north as Busan and could stay strong enough to impact Shenzhen later this week.

The series of storms has prevented impacted ports from completely clearing backlogs before new shutdowns, with as many as ninety ships waiting more than a week for a slot in Shanghai, and carriers skipping calls at backed up ports leading to increased transhipment volumes at other ports in the region.

Far East congestion – as well as N. Europe hub backlogs, partly due to low, but improving, water levels in the Rhine – is also a factor to current Asia – Europe rate levels. Prices have cooled on easing demand since mid-July but capacity constraints may be helping rates remain above pre-peak levels. Asia – N. Europe prices have fallen more than $1,000/FEU since their July peak, but at $4,600/FEU are up about 70% compared to before the early start of peak season in mid-May. Rates at $4,800/FEU to the Mediterranean are down more than $2,000/FEU but are still 40% higher than three months ago.

Transatlantic rates climbed $400/FEU in the last two weeks to $2,600/FEU as carriers reduce capacity on the lane. Several carriers are planning additional, significant price increases for September, though some observers are skeptical that these rate hikes will stick.

In air cargo, the Freightos Air Index global benchmark eased 10% last week, but remains more than 20% higher than a year ago due to elevated fuel costs and some lingering capacity constraints. Far East – US rates eased 7% to about $6.00/kg and prices to Europe ticked up 1% to $4.60/kg last week, though both lanes are trending up so far this week, possibly due, once again, to typhoon-driven disruptions.

Freightos Terminal™: Real-time pricing dashboards to benchmark rates and track market trends.

Procure™: Streamlined procurement and cost savings with digital rate management and automated workflows.

Rate, Book, & Manage™: Real-time rate comparison, instant booking, and easy tracking at every shipment stage.

Weekly highlights

Ocean rates – Freightos Baltic Index

- Asia-US West Coast prices (FBX01 Weekly) decreased 1%.

- Asia-US East Coast prices (FBX03 Weekly) decreased 3%.

- Asia-N. Europe prices (FBX11 Weekly) decreased 3%.

- Asia-Mediterranean prices (FBX13 Weekly) decreased 1%.

Air rates – Freightos Air Index

- China – N. America weekly prices increased 5%.

- China – N. Europe weekly prices increased 6%.

- N. Europe – N. America weekly prices stayed level.

Analysis

Tensions between Iran and the US continue to climb around the Strait of Hormuz, with Iran now announcing plans to impose a wider exclusion zone on areas near the strait. Fuel rates have trended up since the ceasefire collapse in July, but recent escalations as well as an increase in Chinese crude imports have pushed bunker fuel prices back up to levels last seen in June. Jet fuel prices are back to May levels with both fuels about 60% higher than before the start of the war.

Climbing fuel costs are likely setting an elevated floor for container rates, but ocean prices are still largely being driven by demand trends and disruptions to capacity availability.

Transpacific ocean rates cooled slightly last week, suggesting there won’t be additional rate increases in what is likely the last few weeks of peak season. But elevated demand that started in late May has kept prices at peak levels since early July. Current rates – of about $7,600/FEU to the West Coast and $9,500/FEU to the East Coast – are about back to levels last seen during peak season in 2024 when seasonal demand, Red Sea disruptions to capacity and some frontloading ahead of a possible East Coast labor strike combined to push rates up sharply.

Severe typhoon-driven congestion at Far East container hubs are likely also contributing to current rate levels. Carriers have increased blanked sailings for this week – possibly as moves to recover schedules disrupted by the storms – which could also help keep prices elevated even if demand has started to ease.

The Panama Canal Authority has postponed an additional half-foot draft reduction for Neopanamax transits until further notice, though it is still bracing for drought conditions from the expected El Nino this year. The PCA reduced daily transits by four to 32 this month, though Neopanamax daily slots – used by long haul container vessels – have only been reduced by one.

Asia-Europe container rates ticked down slightly last week to $4,500/FEU to N. Europe and $4,700/FEU to the Mediterranean, though Mediterranean prices have cooled further so far this week to about even with N. Europe. Going back to 2017, Asia – Mediterranean rates have on average been 17% higher than Asia – N. Europe prices, though at times they have been lower.

The current sharper decline from peak season highs for Mediterranean rates – a $2,600/FEU and 37% drop compared to $1,300/FEU and 23% for N. Europe lanes – may reflect both the recent increase in Red Sea transits for some Mediterranean services and that congestion at N. Europe hubs is keeping upward pressure on rates for those lanes even as peak season demand has cooled. Even with these declines, rates for both lanes remain $1,000 – $1,700/FEU above pre-peak season levels, likely due to Far East congestion as well. Recent port worker strikes in Germany and the Netherlands are now also contributing to some of the backlog.

In air cargo, operations at Miami International Airport are back to normal after an Amazon freighter crash on Sunday and authorities have reopened most airports across Indonesia following a volcanic eruption that had closed airports since late Friday. Air cargo rates from the Far East increased about 5% last week to $6.30/kg to the US and $4.88/kg to Europe, possibly reflecting disruptions from the most recent typhoon to hit the region last week.

Freightos Terminal™: Real-time pricing dashboards to benchmark rates and track market trends.

Procure™: Streamlined procurement and cost savings with digital rate management and automated workflows.

Rate, Book, & Manage™: Real-time rate comparison, instant booking, and easy tracking at every shipment stage.

Weekly highlights

Ocean rates – Freightos Baltic Index

- Asia-US West Coast prices (FBX01 Weekly) increased 3%.

- Asia-US East Coast prices (FBX03 Weekly) increased 2%.

- Asia-N. Europe prices (FBX11 Weekly) decreased 3%.

- Asia-Mediterranean prices (FBX13 Weekly) decreased 12%.

Air rates – Freightos Air Index

- China – N. America weekly prices increased 3%.

- China – N. Europe weekly prices increased 8%.

- N. Europe – N. America weekly prices increased 1%.

Analysis

The Houthis – previously in control of the elevated area miles from the Red Sea – recently seized a strategic port and island directly on the Bab el-Mandeb Strait chokepoint. This advance, together with last week’s attack on a key Saudi pipeline, marks yet another escalation in Iran-backed steps to threaten energy markets.

Some experts watching oil and bunker fuel prices climb back to May levels, see these recent developments as further evidence that strategies which reduced energy prices from initial war-time highs – mostly by drawing from reserves – are wearing thin and could now lead to an actual fuel crisis.

The Houthis had no difficulty attacking and deterring Red Sea traffic before they took control of the coastal region, but their recent gains mark a solidification of control and an escalation of the maritime threat. Nonetheless – and despite some shipper objections – container carriers continue to increase Suez Canal and southern Red Sea transits.

According to Sea Intelligence estimates, more than a quarter of Asia-Europe capacity will sail via the Red Sea in September, with 35% of Asia – Mediterranean headhaul capacity and 50% to 60% of backhauls passing through the Suez. Asia – N. Europe capacity is returning at a slower pace with 6% of headhaul and 30% of backhaul being restored so far.

War-driven higher fuel costs, and congestion at both Far East origin ports – which may keep dismal on-time rates and backlogs a factor post Golden Week and well into October – and N. Europe hubs may be changing carrier calculus for a Red Sea return. The added speed and effective capacity the new routes provide may already be responsible – together with easing, post-peak demand – for container rate decreases on these lanes.

Asia – N. Europe prices fell 3% to about $4,300/FEU last week while Asia – Mediterranean rates dropped 12% to $4,200/FEU. Daily rates on both lanes have eased to about $3,800/FEU so far this week. The sharper drop for Asia – Mediterranean prices – down $3,000/FEU from a July peak compared to $2,000/FEU for N. Europe rates – may reflect the higher rate of Red Sea capacity restoration on this lane. That, even with demand reductions and Red Sea transits, prices on these lanes remain respectively more than 20% and 50% higher than before peak season began in mid-May points to the role congestion continues to play in container rate dynamics.

Transpacific container rates meanwhile ticked up last week, remaining at peak levels as demand strength – together with Far East congestion – is keeping pressure on spot prices. The latest National Retail Federation US ocean import volume report projects October arrivals to fall 9% compared to September, with a further drop in November, suggesting that demand is already easing and should ease further soon. Port congestion – as well as blanked sailings over the holiday stretch – could nonetheless mean rates will stay quite elevated even as demand cools. While most carriers do not seem to be planning October increases, CMA CGM announced sharp PSSs especially for S. Asia – US lanes.

In air cargo, UK operations continue to recover from an air traffic control system outage that grounded thousands of flights a week ago. Overall the Freightos Air Index global benchmark is down 5% from recent, possibly typhoon-related levels, and has decreased 15% from levels hit early on in the Iran war. But rates remain 25% higher than a year ago as jet fuel costs stay high.

Far East – N. America prices climbed 3% to $6.52/kg last week and rates to Europe increased 8% to $5.25/kg. Despite global volume growth so far this year, some observers do not expect a particularly strong Q4 peak season. This stance is due partly to non-seasonal, AI-related hardware being a big driver of volumes, and limited to only some lanes – particularly, Taiwan, South Korea and S. East Asia to US corridors. On these lanes, however, some forwarders expect capacity to be tight over peak season, and even push some volumes to ocean or sea-air options.

Freightos Terminal™: Real-time pricing dashboards to benchmark rates and track market trends.

Procure™: Streamlined procurement and cost savings with digital rate management and automated workflows.

Rate, Book, & Manage™: Real-time rate comparison, instant booking, and easy tracking at every shipment stage.

Stop managing freight costs reactively. Learn how leading procurement teams stay ahead.

Fuel surcharges swing 15–25% within a single quarter. Annual tender cycles can’t keep pace. And yet most procurement teams still rely on manual processes, spreadsheets, and outdated rate data to manage some of their biggest cost lines.

In our recent webinar we showed exactly how agile procurement works in practice — from standardizing and automating your tendering process to managing fuel and BAF updates between tender cycles without the overhead of a full renegotiation.

Watch the full recording and key takeaways below:

- Automate Your Procurement Workflows: See how Freightos Procure automates up to 90% of manual freight procurement tasks — from RfQ generation and carrier management to sanity checks and best-rate calculations — so your team focuses on decisions, not admin.

- Manage Fuel and BAF Updates Between Tenders: Learn how to run structured BAF review cycles between full tenders, using either your own methodology or carrier-submitted updates — with built-in approval workflows and full audit trails.

- Benchmark Rates Against the Real Market: See how Freightos Terminal gives you daily-updated spot and contract benchmarks sourced from $50B+ in real commercial freight spend — so you always know where your rates stand before you negotiate.

We’ve created a short guide to help get you started. Download it for free below:

Your Expert Hosts

Judah Levine

Head of Research, Freightos Group

Florian Gottlieb

Enterprise Account Manager, Freightos

The global supply chain has faced significant disruptions in recent years — from a worldwide pandemic and geopolitical tensions to climate-related events and market volatility. Traditional freight procurement, built on rigid annual contracts and slow negotiation cycles, simply can’t keep pace.

Agile logistics procurement changes that. By leveraging short-term tenders, real-time data, and flexible supplier relationships, procurement teams can respond quickly, control costs, and build more resilient supply chains — no matter what the market throws at them.

Download our playbook to discover how leading enterprise procurement teams are making the shift.

What you’ll learn in this step-by-step playbook:

✓ How to standardize, centralize, and automate your procurement workflows – including fuel and BAF updates

✓ How to benchmark your contracted rates against real commercial freight spend and run regular mini-bids to stay competitive

✓ How to track procurement KPIs and continuously optimize freight costs between tender cycles – without a full renegotiation

Frequently Asked Questions

What is Agile Logistics Procurement?

Agile logistics procurement is a dynamic approach to freight sourcing that replaces rigid annual contracts with frequent mini-bids, real-time market data, and flexible supplier relationships. It enables enterprise procurement teams to respond quickly to market shifts, control freight costs more effectively, and build more resilient supply chains.

How does Agile Procurement reduce freight costs?

By running regular mini-bids and benchmarking contracted rates against live market data, procurement teams can identify overpayment, optimize carrier selection, and act on cost-saving opportunities as they arise — rather than waiting for the next annual tender cycle. Tools like Freightos Terminal allow teams to compare their rates against $50B+ in real commercial freight spend to see exactly where savings are available.

What is BAF and how can procurement teams manage it more effectively?

BAF (Bunker Adjustment Factor) is a surcharge applied to ocean freight rates to account for fluctuations in bunker fuel costs. It can swing 15–25% within a single quarter, making it one of the most volatile cost lines in freight procurement. Agile procurement teams manage BAF more effectively by running structured update cycles between full tenders — either applying their own methodology or requesting updated submissions directly from carriers — rather than absorbing surcharge changes passively.

What tools do enterprise procurement teams use for freight rate benchmarking?

Leading enterprise procurement teams use market intelligence platforms like Freightos Terminal to benchmark contracted rates against daily-updated spot and contract data across ocean and air freight. Unlike self-reported data used by some competitors, Freightos Terminal is sourced from real commercial transactions representing over $50 billion in annual freight spend — giving procurement teams a reliable, independent view of where their rates stand before they negotiate.