November 17, 2016 By Security Intelligence Staff 2 min read

IBM Security recently launched and announced quite a few initiatives designed to help organizations defend against cyberattacks, including:

  • The opening of the fully operational X-Force Command Cyber Range. This space immerses participants in simulated cyberattacks to train them to properly prepare for, respond to and manage a broad variety of threats.
  • The upgrade of the IBM X-Force Command Center Atlanta, a security operations center that IBM has operated for 15 years. The facility now handles over 35 billion security events per day — a 75 percent increase in capacity.
  • The formation of the new IBM X-Force IRIS Team, an incident response and intelligence consulting service. Over 100 elite cybersecurity consultants around the world use IBM’s X-Force Threat Intelligence network to help clients understand where and how cyberattacks are being launched so they can defend against and remediate them with greater speed and accuracy.

A Tour de X-Force

You might have noticed that X-Force has a hand in all these initiatives. So we sat down with Nick Bradley, an X-Force Research Practice Lead, to learn more about the evolution of the IBM X-Force team and its objectives.

Question: How has IBM X-Force changed over time?

Bradley: Our mission has always been based on protecting our clients. However, over time, that mission has expanded into a great many different areas. Whereas the main focus was to monitor threats and vulnerabilities to create coverage in IBM products, we now do much more in the way of pure research.

We are now the center for information sharing within IBM and, in many cases, outside of IBM through the amazing capabilities of the X-Force Exchange. My X-Force Threat Research team and X-Force Threat Analysis team have moved on from just reporting the news to discovering it and publishing it as original works.

It is only right that all of this progress benefit what we used to call the security operations center (SOC). Now being bolstered by all the arms of the X-Force, it seemed logical to rebrand the SOC as the X-Force Command Center.

What gives IBM X-Force an edge over other commercial research groups?

Bradley: Simply stated, experience. X-Force has been doing this since before cybersecurity was a household word. We have access to copious amounts of data from around the world and from many different sectors. This gives us a unique perspective into the threat landscape.

How does the research from IBM X-Force support enhancements to our protection solutions for clients?

Bradley: I almost want to say that this is a no-brainer, but I know that is only due to my involvement. The research being done is communicated up, down and across, through multiple channels, to keep all the different facets of IBM Security informed. Our discoveries usually make their way directly into the IBM products, either at a signature level or on a correlation level. The information sharing channels we have developed make this easier and easier.

Anything else you might want to add related to the X-Force Command Center?

Bradley: It’s cool! The X-Force Command Center is a state-of-the-art working and collaboration environment developed by analysts for analysts. Gone is the dark, dank dungeon look where even working with someone 10 feet away was difficult due to the floor layout. This is a very comfortable work environment that enables collaboration.

More from

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

Crisis communication: What NOT to do

4 min read - Read the 1st blog in this series, Cybersecurity crisis communication: What to doWhen an organization experiences a cyberattack, tensions are high, customers are concerned and the business is typically not operating at full capacity. Every move you make at this point makes a difference to your company’s future, and even a seemingly small mistake can cause permanent reputational damage.Because of the stress and many moving parts that are involved, businesses often fall short when it comes to communication in a crisis.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today