• ESET NeoCortex, a state-of-the-art foundational AI model powering ESET LiveCortex, enables deeper incident understanding, reconstructs missing incident context, and provides early insight into attack progression for defenders aiming for “minus-one-day defense”.
• Via highly optimized training, cybersecurity specialization and smart engineering, ESET NeoCortex delivers significantly more accurate, defense-oriented results at 1/200th of the training cost of general-purpose AI models.
• ESET NeoCortex, with a never-go-rogue  design, employs multi-layered measures including restricted sandboxes, read-only tools, continuous monitoring, a kill switch and human expert oversight of critical response decisions.
• Developed and self-hosted within ESET’s secure environment, the model ensures that critical workloads, sensitive security data and model operations remain under ESET’s control, reducing exposure to abrupt shifts in third-party AI providers, commercial or geopolitical spheres.

Bratislava, Slovakia — October 27, 2026 —ESET, a global leader in cybersecurity, today introduced ESET NeoCortex, its specialized, foundational cybersecurity model powering ESET LiveCortex. Available within the ESET PROTECT Platform, ESET LiveCortex connects, enriches and prioritizes fragmented security signals to turn them into actionable incidents.

Powered by ESET NeoCortex, ESET LiveCortex processes billions of raw telemetry events daily, correlating the signals that matter into actionable incidents. Just 0.00111% of those events – approximately 1 in 90,000 – contribute to incidents presented to customers, separating meaningful activity from noise. By reducing alert fatigue and prioritizing incidents that warrant attention, ESET’s AI technology strengthens human expertise and helps defenders act before attackers reach their objectives.

“AI is accelerating both cyberattacks and cyberdefenses. With ESET NeoCortex, we are applying our AI investment to develop specialized foundational cybersecurity intelligence that remains under our control and strengthens, rather than replaces, human expertise,” said Juraj Malcho, Chief Technology Officer at ESET. “This is an important step toward a new generation of predictive, AI-powered security operations leveraging world-model architecture.”

Built for structured, time-dependent and adversarial security data, NeoCortex draws on patterns learned from real security incidents to analyze activity in context, recognize similar cases and estimate an attacker’s likely next step.

The need for this contextual analysis becomes especially clear during periods such as Black October – specifically the week leading up to Oct 25, 2026 – when critical security issues affecting PHP, Linux, GitLab and other key systems demanded rapid, prioritized responses. ESET NeoCortex is designed to help analysts make these critical decisions, while keeping human defenders in control.

Modern business environments generate vast amounts of raw security data across endpoints, identities, cloud workloads, networks, and applications. With shrinking time to detect and respond to attacks, the challenge is to process the inputs and determine which signals belong together, which point to a possible threat, and what action to take next.

Within the ESET PROTECT Platform, ESET LiveCortex acts as a nerve center for business protection. It connects signals that may appear harmless in isolation – such as sign-in anomalies, suspicious process launches, unusual connections, configuration changes and subsequent attempts to access data – into prioritized incidents. This gives defenders a focused view, reduces manual investigation and prevents repeated low-value alerts from consuming analyst time.

ESET NeoCortex – an AI model built on world-model architecture – enhances the process of reducing raw telemetry to focused incidents by learning how digital environments behave, how events relate and what may happen next, helping security teams investigate incidents more efficiently and identify potential attack progression early.

These investigation capabilities require a model built specifically for the structure and behavior of security data. While general-purpose large language models are designed to produce plausible responses across a wide range of topics, security operations require consistent analysis of entities, timestamps, indicators, process relationships and incomplete observations across a developing incident.

ESET NeoCortex is designed for these requirements. It can reconstruct missing incident context, create compact representations of complex incidents and identify anomalous events within a wider attack sequence. Its world-model approach also estimates how an attack may progress, giving defenders an opportunity to intervene before the next stage unfolds – a “minus-one-day defense.”

It does not operate as a standalone decision maker. It forms part of a layered security architecture combining specialized models, deterministic controls, correlation logic, validation, auditability and expert human oversight.

ESET’s internal research shows that a specialized model such as ESET NeoCortex can be trained at up to a 200 times lower cost than a large general reasoning model, while delivering more accurate, defense-focused results. These efficiencies come from ESET- optimized training, focus on cybersecurity vocabulary, purpose-built security engineering, lower computing requirements and privately owned hardware.

For defenders, this translates into more frequent updates to learned incident patterns, lower infrastructure overhead and more predictable costs, with computing resources focused on security analysis rather than broad conversational capabilities.

As AI becomes integral to cybersecurity infrastructure and a target itself, ESET has designed ESET NeoCortex to operate under strict safeguards to ensure that the AI never escapes and never “goes rogue” on the open internet. These include restricted sandboxes, read-only tools, continuous monitoring, defined usage and token limits, a kill switch and human expert oversight of critical response decisions.

Developed and operated on ESET’s own infrastructure, ESET NeoCortex keeps sensitive security data and model operations under ESET’s control. This self-hosted approach reduces reliance on third-party AI providers and supports stronger data governance, consistent protection and operational continuity reducing customer exposure to shifts in geopolitical, commercial, and AI provider spheres.

San Diego, Calif. — September 1, 2026 — ESET, a global leader in cybersecurity, today announced a new partnership with Cysurance, a leading next-generation risk mitigation company, that delivers the first fully integrated warranty protection program for ESET MDR customers. This new offering gives businesses instant warranty coverage via the purchase of ESET’s MDR subscription tiers, enabling customers to secure same-day cyber insurance without underwriting at discounts of up to 60–80% off standard market premiums.

“We’re thrilled to partner with Cysurance to bring a warranty solution directly to our MDR customers,” said Ryan Grant, Country Manager, US & Canada, for ESET North America. “Businesses often face long delays, complex applications, and steep premiums when seeking financial coverage in case of cyber incident. Through this partnership, ESET customers gain immediate warranty protection and a dramatically simplified path to meeting coverage requirements. It’s an offering that reflects our commitment to helping organizations strengthen their security.”

The partnership strengthens ESET’s cyber resilience ecosystem by combining advanced Managed Detection and Response (MDR) capabilities with financial protection designed to help organizations recover more quickly from qualifying cyber incidents. Beyond warranty protection, the partnership expands ESET’s access to a broader ecosystem of insurers, brokers, managed service providers, incident response specialists and cyber-risk stakeholders, strengthening ESET’s ability to support customers throughout the cyber resilience lifecycle.

Through the partnership, all customers purchasing ESET PROTECT MDR or ESET PROTECT MDR Ultimate will automatically receive a cyber warranty valued at $500,000 or $1 million, depending on the selected tier. The warranty is activated upon purchase and when all the required cyber controls are enabled. The required cyber controls are designed to help customers reduce risk before an incident occurs, strengthening their overall security posture while providing the added assurance of warranty protection should a qualifying incident take place. Within 24 to 48 hours after discovering a breach, businesses can submit a claim to cover urgent breach-response needs, including hiring forensic firms, legal services, PR assistance, or replacing compromised hardware. Claims are managed through Cysurance’s streamlined process to help organizations access support quickly following a qualifying incident.

Customers will also gain access to Cysurance’s automated online portal, where they can optionally bind cyber insurance in minutes, without lengthy applications or questionnaires. Because ESET has been vetted and approved as a preferred vendor by Cysurance, policyholders receive deeply discounted rates—often as low as 60–80% off standard market premiums.

“ESET stands out because of the breadth and quality of its cybersecurity platform,” said Kirsten Bay, Co-Founder and CEO of Cysurance. “Its integrated approach to prevention, detection, and response makes it an ideal partner for our warranty and cyber insurance programs. Together, we are giving organizations confidence that they have both the technical protection to reduce risk and the financial protection to recover quickly when incidents occur.”

While available initially in the United States and Canada, the offering is expected to expand globally, aligning with Cysurance’s international capabilities and ESET’s worldwide footprint.

ESET MDR delivers 24/7 threat monitoring, detection, and response powered by advanced AI-powered technology and human expertise. Combined with the new cyber warranty offering from Cysurance, customers can benefit from both proactive protection and financial support designed to accelerate recovery from qualifying cyber incidents.

• ESET PRIVATE Scanning Solutions are now available in AWS Marketplace.
• AWS Marketplace is a curated digital catalog where businesses can find, buy, and deploy third-party software, data products, and professional services that run on AWS. 
• AWS customers can streamline the purchase and management of ESET PRIVATE Scanning Solutions within their AWS Marketplace account.  

BRATISLAVA — August 19, 2026 — ESET, a global leader in cybersecurity solutions, announced today that its ESET PRIVATE Scanning Solutions are now available in AWS Marketplace.

Customers increasingly expect seamless purchase and service options when seeking to procure products, and this is helping to establish AWS Marketplace as a primary commercial and deployment channel. AWS customers will now have access to ESET PRIVATE Scanning Solutions’ ultra-fast multilayered threat scanning directly within AWS Marketplace, and are able to streamline purchase and management within their AWS Marketplace account. This helps to reduce time-to-value and allows security and DevOps teams to deploy the solution faster.

“Today’s organizations expect security solutions they can evaluate quickly, purchase seamlessly, and deploy without delay. By making ESET PRIVATE Scanning Solutions available in AWS Marketplace, we’re simplifying procurement while enabling organizations to integrate high-performance threat scanning into their cloud applications to help protect critical data flows,” said Head of Corporate Solutions NORAM, Andrea Doyle. 

ESET PRIVATE Scanning Solutions’ static scanning engine scans large volumes of inbound data, providing real-time threat detection that scales dynamically with workloads. It enables organizations to inspect files before they are stored, shared, or processed. Built for accuracy, it uses advanced behavioral analysis to detect malware and zero-day threats, integrating into apps, storage platforms, upload portals, and others, to detect malware in milliseconds without requiring full endpoint security deployment. 

Visit AWS Marketplace to learn more and try our scanning solution for one month for free.

Discover the benefits of ESET PRIVATE’s tailored security line.

Learn more about ESET PRIVATE Scanning Solutions and its use case for enterprise data pipelines.

LAS VEGAS — August 3, 2026 — ESET, a global leader in cybersecurity, today announced cutting-edge security AI solutions at Black Hat 2026 in Las Vegas, Nevada. ESET is expanding its AI capabilities across threat detection, investigations, threat protection, and security operations, delivering added value to customers through built-in innovations rather than separate add-on solutions.

“AI is a new class of actor inside the company – reading, writing, making decisions and executing. As such, it deserves the same security attention as users and endpoints, because it behaves like both at once,” said Kamil Pšenák, Senior AI Product Manager at ESET. “It is all converging around the endpoint. What used to be a neglected part of the cybersecurity stack is now primed to shine anew thanks to the proliferation of AI tools at a business level.”

As a pioneer in AI and machine learning for more than two decades, ESET has long used AI to strengthen threat prevention and detection. As organizations rapidly adopt AI tools and autonomous agents—often without IT oversight—ESET is expanding its portfolio to help customers secure AI itself, reducing the security and compliance blind spots created by shadow AI. Available September 30 across the ESET PROTECT portfolio, new features include:

• ESET AI Agent Security: As autonomous AI agents access files, download components, call external services, use repositories, interact with code, or rely on skills and plugins, they may introduce malicious or compromised elements into the customer environment. AI Agent Security helps protect against this risk by inspecting AI-related components across the entire AI supply chain.
• ESET AI Behavioral Monitoring: Where AI Agent Security helps inspect components and supply-chain activity, AI Behavioral Monitoring focuses on the behavior and actions of autonomous agents. It is designed to detect and block malicious or suspicious activity from AI agents, such as agents that attempt to access inappropriate resources, run unsafe actions, or behave outside the expected scope of their task.
• ESET AI Conversation Security: Designed for organizations using generative AI tools, this capability helps reduce the risk of unsafe prompting or accidental data leakage by inspecting uploaded files and metadata for sensitive content. It also helps protect users from malicious AI-generated responses by flagging content originating from phishing, malicious, or unwanted websites.

Built on ESET’s best-in-class prevention system and decades of AI expertise, these new capabilities help organizations manage AI risk without adding complexity. ESET owns the technology, models, and intelligence behind these protections, embedding them directly into ESET AI Technologies rather than bolting on third-party solutions, or requiring customers to manage separate tools and platforms.

By extending protection to AI agents, behaviors, and conversations, ESET empowers channel partners and IT teams to secure the AI era and defend against emerging threats at scale through a single, unified solution that delivers stronger protection with less operational overhead and no additional cost.

“AI is changing the conversations our partners are having with customers,” said Ryan Grant, Country Manager, U.S. and Canada at ESET. “Instead of simply reacting to new AI risks, partners can lead with a prevention-first strategy that helps businesses adopt AI securely while reducing operational complexity. That’s a meaningful opportunity to deepen customer relationships and grow recurring security services.”

At Black Hat 2026, visitors to ESET’s booth #4917 can learn more about the company’s AI-driven cybersecurity innovations, threat intelligence and managed detection and response (MDR) capabilities. Throughout the event, ESET researchers, partners, product leaders and cybersecurity experts will present on the impact of AI on cybersecurity, real-world MDR incident response and how to build resilience through intelligence-led defense.

Highlights at Black Hat 2026 include:

• Thursday, Aug. 6, 2:05–2:25 p.m. – Kamil Pšenák will present The Shock of AI Impact and How to Absorb It at Pulse Stage 5, examining how organizations can responsibly adopt AI while defending against emerging cyber threats.
• Thursday, Aug. 6, 3:15–3:35 p.m. – Tony Anscombe will join Dark Reading panel discussion, Cyber Extortion Hacked, at Pulse Stage 5 to discuss the rise of data extortion attacks and practical response strategies.
• Wednesday, Aug. 5, 3:00 p.m. & Thursday, Aug. 6, 1:00 p.m. – Celebrity book signing with Tanya Janca, internationally recognized application security expert, author, and founder of SheHacksPurple, featuring signed copies of Alice and Bob Learn Secure Coding while supplies last.
• ESET x Intel: Intelligence-Led Defense – ESET’s Kamil Pšenák and Intel’s Tyler Welt will showcase how ESET PROTECT leverages Intel DTECT, using processor-level execution telemetry and AI models to identify sophisticated threats, alongside advanced Cloud Workload Protection capabilities that improve visibility, simplify security operations and transform SOCs from reactive to proactive.
• Interactive experiences including the Cybersecurity Trivia Showdown and The Great Escape: Cyber Challenge, where attendees can test their cybersecurity knowledge and skills.

Discover more about ESET’s presence at Black Hat 2026. Learn more about AI and ESET.

• ESET researchers discovered 11 old, Microsoft-signed, UEFI applications that allow bypassing UEFI Secure Boot on the majority of UEFI-based systems.
• An attacker exploiting one of these vulnerable applications can execute untrusted code during system boot, enabling deployment of malicious UEFI bootkits or other malware.
• Exploitation is not limited to systems with the affected software or Operation system (OS) installed, as attackers can bring their own copy of the vulnerable binaries to any UEFI system with the Microsoft third-party UEFI certificate enrolled.
• All UEFI systems with Microsoft third-party UEFI signing enabled are affected (Windows 11 Secured-core PCs are expected to have this option disabled by default).
• The vulnerable binaries were revoked by Microsoft.

BRATISLAVA — July 14, 2026 — ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities. UEFI shim bootloaders are tiny bits of code designed to bridge the gap between motherboard UEFI firmware and an operating system. The vulnerable shims, at versions 0.9 and below, can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts the Microsoft Corporation UEFI CA 2011 third-party UEFI certificate authority (CA) certificate, regardless of the installed operating system. Reported shims can be exploited to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits even on systems with UEFI Secure Boot enabled. ESET reported findings to CERT/CC; the vulnerable UEFI applications were then revoked.

The discovered shims come from various tools or software packages, including PC-diagnostic software, Linux distributions, and other UEFI-based utilities. Importantly, exploitation is not limited to systems with the affected software or OS installed, as attackers can bring their own copy of the vulnerable shims to any UEFI system with the Microsoft third-party UEFI certificate enrolled.

“What makes these old shims dangerous is not a novel vulnerability; it’s that no new vulnerability is needed to bypass UEFI Secure Boot. An attacker needs no complicated exploitation primitives – only a copy of an old, still-trusted, but unrevoked shim binary and a basic understanding of how UEFI shims work. That is enough to bypass such an essential security feature as UEFI Secure Boot,” says ESET researcher Martin Smolár, who discovered the vulnerable shims.

“To understand the impact that such vulnerable shims can have on UEFI Secure Boot-protected systems, in the report we examine a few specific issues in the reported shims – issues that are easily exploitable and that highlight the breadth of the attack surface they expose,” adds Smolár.

Over the years, the UEFI shim bootloader has naturally evolved, with new improvements and security features introduced in successive releases of the upstream UEFI shim repository. At the same time, many third-party vendors have taken available versions of the shim source code to build their own binaries, which they subsequently submitted to Microsoft for signing. This behavior is expected and aligns with the original design of shims. However, insufficient attention has been given to revoking outdated Microsoft-signed shims, many of which can, by design, be leveraged to bypass newer security mechanisms. 

These vulnerable shims can be blocked by applying the latest UEFI revocations from Microsoft. Windows systems should be updated automatically.  For Linux systems, updates should be available through the Linux Vendor Firmware Service. For more general recommendations regarding how to protect against (or at least detect) exploitation of unknown vulnerable signed UEFI bootloaders and deployment of UEFI bootkits, see ESET Research blogpost: Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344.

For a more details about the vulnerable UEFI shims, check out the ESET Research blogpost “Forgotten UEFI shims undermining Secure Boot” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Simplified UEFI boot flow on Linux systems

• ESET Research has released its H1 2026 Threat Report with statistics from December 2025 through May 2026.
• ClickFix – a social engineering technique leveraging fake error messages – has expanded into AI-themed help pages, browser extensions, and cloud authentication scenarios.
• QR code phishing – also known as quishing – has reached record levels in ESET telemetry.
• ESET analyzed nearly 900,000 AI skills – small functional components used by AI agents – and identified tens of thousands of suspicious and thousands of malicious instances. AI is also beginning to appear within malware.
• Ransomware showed no signs of slowing down, with its continued use of EDR killers – tools designed to disable security software during attacks.

Unique AI skills scanned by ESET systems per day, seven-day average