Vaikora › Blog › Product Updates

Staging-phase detection: how Cyren identifies malicious infrastructure before a campaign reaches your users

Product Updates · Nov 6, 2026 · 4 min read

A threat actor registers a domain, configures mail infrastructure, and tests delivery routes days before sending a single phishing email. By the time that email arrives in an inbox, the infrastructure has already been active. Most detection tools only see it at delivery.

Cyren's approach works at the staging phase, which changes what your SOC receives and when.

What the GlobalView network actually sees

Cyren Threat Intelligence runs on the GlobalView telemetry network, processing over a billion email, URL, and file transactions every day. That volume is not a performance claim. It is what makes early staging-phase detection possible.

When a threat actor provisions infrastructure, they typically send test messages, probe deliverability, and register domains that share patterns with known malicious clusters. At the scale GlobalView operates, those test transactions appear. They look like noise individually. Across a billion daily transactions, the signal separates from the background.

The result is that Cyren detects phishing and malicious infrastructure during staging, before campaigns are weaponized. Your team gets indicators on infrastructure that has not yet fired against your users.

What your SOC receives

Cyren ships as a packaged solution through Microsoft Sentinel Content Hub. The package includes the CCF connector, analytic rules, hunting queries, and workbooks. There is no custom connector work. You install the solution, the connector authenticates, and indicators start flowing into your Sentinel workspace.

The analytic rules map to the indicators Cyren pushes. A domain flagged during infrastructure staging becomes a Sentinel alert if it appears in your logs. The hunting queries let analysts pull on the same data proactively rather than waiting for an alert.

Cyren also pushes indicators directly into CrowdStrike Falcon and SentinelOne. If your detection workflow runs through either of those platforms rather than Sentinel, the same staging-phase signals reach your enforcement layer. An indicator on malicious infrastructure can translate into a block before the campaign reaches delivery.

A concrete scenario

An analyst is reviewing a Sentinel incident. The triggered rule references a domain that Cyren flagged 36 hours earlier, during what appears to have been infrastructure testing. The domain has since appeared in outbound DNS queries from two endpoints.

Because the indicator arrived before the campaign went live, the analyst has a time window that post-delivery detection does not provide. They can pull the hunting query for that domain, see which internal hosts queried it, and determine whether any of those queries preceded other suspicious activity. The investigation starts with context rather than starting from scratch after a user clicks.

That sequence only works if the indicator was already in your SIEM when the DNS query happened. Post-delivery detection of the same domain would have meant the analyst was working backward from an event that already occurred.

Connecting threat intelligence to enforcement

Detection produces alerts. Enforcement acts on them. The gap between the two is where threats move.

When Cyren pushes indicators into CrowdStrike Falcon or SentinelOne, those platforms can apply blocking decisions based on the indicator. A domain known to be staging infrastructure does not need to reach a user before it is blocked at the DNS or network layer. The indicator from GlobalView telemetry becomes an enforcement signal.

This is a different posture from signature-based filtering at the mail gateway. Gateway filtering matches against known bad content at delivery. Staging-phase telemetry lets you act on infrastructure that has been identified as malicious before it is used to deliver anything.

For SOC teams running Vaikora alongside Cyren, threat intelligence indicators from Cyren can inform the broader detection surface. Vaikora pushes AI agent threats into SentinelOne as Threat Intelligence indicators with severity mapping, and both Cyren and Vaikora feed into the same SIEM and enforcement platforms. That consistency matters when you are trying to maintain a coherent picture of risk across email, network, and AI agent activity.

What to check next

If you are running Microsoft Sentinel, go to the Content Hub and search for the Cyren solution. Review what analytic rules ship with it and whether your current log sources would satisfy the correlation logic. Then look at whether your CrowdStrike Falcon or SentinelOne configuration is set to act on incoming threat intelligence indicators automatically or whether that requires manual promotion. The gap between receiving an indicator and enforcing on it is usually a configuration decision, not a capability gap.

More from the Vaikora blog