Blog · 21 analyses

Cybersecurity, explained. No jargon.

Our analysis of the managed SOC, AI in cybersecurity, NIS2/DORA compliance and digital sovereignty.

Sovereignty26 avril 2026

Sovereignty made in France: HDS v2 hosting at Unitel plus on-premise SYLink AI — no compromise

Most so-called sovereign SOCs are in fact US hybrids (OpenAI, Slack, Datadog, Stripe). UniSOC does the opposite, without compromise: HDS v2 at Unitel in Marseille, on-premise SYLink AI on Blackwell GPUs, zero outbound request. The full technical stack, detailed and auditable.

Read the article

An on-premise GPU processing logs with no internet connection

AI & XDR12 min

AI in the SOC: why UniSOC does not send your logs to OpenAI

Many SOC vendors bolt on an AI layer by calling OpenAI, Anthropic or Gemini. That means shipping logs wholesale to the US, under the Cloud Act. UniSOC does the opposite: an on-premise LLM (Ollama + Sylink2:27b), zero outbound request.

24 avril 2026

Watertight partitions between tenants in a SOC platform

Sovereignty11 min

Tenant isolation: how a pooled MSSP can leak your logs to your competitor

SOC multi-tenancy: five architectural patterns separate an MSSP that genuinely isolates its tenants from one that prays no bug leaks data across them. Real cases, a practical audit, and the UniSOC approach.

21 avril 2026

An MSSP RFP checklist with seven boxes ticked

Compliance11 min

MSSP audit 2026: the 12-question checklist every CISO should put in an RFP

Sovereign hosting, tenant isolation, on-premise AI, SLAs, audit trail, reversibility… twelve operational questions that separate serious MSSPs from marketing brochures. With UniSOC's answers.

17 avril 2026

A counter dropping from 194 days to five minutes

AI & XDR10 min

A 194-day MTTD: why on-premise AI takes detection from six months to five minutes

IBM 2024: 194 days on average before detection. Mandiant on ransomware: 11 days median. UniSOC measures five minutes on the MITRE techniques it covers. Four AI levers (UEBA, narrative, natural-language hunting, scoring) that change the ratio.

14 avril 2026

Incident response12 min

Change Healthcare 2024: 190 million patients, a $22M ransom, the largest healthcare breach in history

Credentials on Telegram → Citrix without MFA → nine days of lateral movement → 6 TB exfiltrated → $22M paid in an exit scam → 190 million US patients affected. Six structural failures, six UniSOC safeguards.

10 avril 2026

Threat Intel10 min

Snowflake 2024: 560 million accounts exposed for want of MFA — lessons for France

AT&T, Ticketmaster, Santander: 160 Snowflake customers compromised in 2024 by UNC5537 using credentials stolen off Telegram. One single cause: MFA was not enforced. How UniSOC monitors credential leaks continuously.

7 avril 2026

An EU datacentre whose logs travel to US authorities

Sovereignty10 min

The Cloud Act and US SIEMs: why your logs are never really yours

In July 2025 Microsoft admitted it could not guarantee confidentiality for its European customers against a US warrant. If your SIEM is Splunk Cloud, Sentinel, Chronicle or US Elastic SaaS, your logs fall under the Cloud Act.

2 avril 2026

Real cases11 min

CrowdStrike, 19 July 2024: when your EDR takes down 8.5 million PCs

An EDR configuration update pushed to 8.5 million Windows machines in 90 minutes. Estimated cost: $5.4bn. Air France grounded, hospitals paralysed, banks frozen. Why UniSOC rolls out its updates in 5/25/100% canary stages.

31 mars 2026

A chain with one weak link picked out in red

Real cases10 min

The SOC as the weak link: four blind spots in security supply chains

SolarWinds, Kaseya, CrowdStrike, Snowflake: four cases proving that the security layer itself has become the adversary's favourite attack vector. The four blind spots, and how to close them.

24 mars 2026

Real cases11 min

MSSPs breached: 87% of security providers hit in 12 months — the real reason

87% of MSSPs suffered a successful attack in 12 months (Huntress 2024). Kaseya, SimpleHelp, Change Healthcare: concentrating privileges and tenants makes the SOC a prime target. How UniSOC is built differently.

17 mars 2026

Incident response10 min

Cyberattacks during the holidays: why summer and Christmas are critical peaks

Attackers know when you are on holiday. Between 40 and 60% of major ransomware attacks in Europe fire during long weekends and holiday periods. Here is why, and how to prepare concretely.

10 mars 2026

The map of France ringed by four sovereign certifications

Sovereignty11 min

Data sovereignty: HDS, SecNumCloud and the GDPR — a 2026 guide

HDS v2, SecNumCloud 3.2, GDPR, NIS2, US Cloud Act: a clear guide to what applies to what, and how to build a compliant architecture without breaking the bank.

3 mars 2026

An AI-generated phishing email with a hook

Threat Intel10 min

AI phishing: how to spot the new attacks generated by ChatGPT

Phishing in 2026 looks nothing like 2020. No more spelling mistakes, no more clumsy phrasing: attackers use LLMs to generate personalised, credible messages in the target's own language.

24 February 2026

Five cards showing AI uses in SOC production

AI & XDR10 min

SOC + AI: five concrete uses of artificial intelligence in threat detection

AI in a 2026 SOC lets four analysts absorb the alert volume that took twelve in 2022. Five concrete uses running in production at UniSOC, with measured gains.

17 February 2026

Personal smartphones connected to Shadow IT SaaS

Risks9 min

BYOD and Shadow IT: securing personal devices without killing productivity

Banning BYOD does not work. Shadow IT and Shadow AI are exploding in 2026. The right approach is not prohibition but visibility, graduated control and behavioural monitoring.

10 February 2026

Working from home: seven cyber blind spots

Risks9 min

Remote working and cybersecurity: seven blind spots outside the office

Between 40 and 60% of staff work at least two days a week away from the office. Most cyber incidents now start on a remote endpoint. Here are the seven most common blind spots.

3 February 2026

An HDS v2 server rack hosted at Unitel in France

Sovereignty8 min

HDS hosting at Unitel: why the choice of datacentre really matters

The datacentre hosting your SOC, your EDR or your business platform is a critical point of sovereignty. Here is why UniSOC chose Unitel: a French datacentre, certified HDS v2 and ISO 27001:2022.

27 janvier 2026

An HDS v2 certification seal on a patient record

Compliance10 min

HDS v2 explained: what the new certification changes for your health data

The HDS v2 certification tightens operational security, aligns with ISO 27001:2022, clarifies which data falls in scope and makes mandatory several requirements that were only recommended in v1.

20 janvier 2026

A neural network prioritising SOC alerts

AI & XDR9 min

AI and the SOC: how artificial intelligence is transforming attack detection in 2026

AI in a 2026 SOC does not replace analysts: it removes 70% of the noise, prioritises the genuinely dangerous alerts and explains in plain language what is going on.

13 janvier 2026

Managed SOC8 min

Managed SOC: why outsource rather than hire in-house in 2026

Building an in-house 24/7 SOC costs €1.8M to €3.5M a year. An equivalent managed SOC: €6,000 to €25,000 a month. But the real difference is time to operation: two to four weeks against 12 to 18 months.

8 janvier 2026

Live in under 48 hours

Ready to see what is really
happening on your network?

First trial free, no credit card, no commitment. On your existing infrastructure.

Start a trial Book a demo