September 2025 Summaries

The text explains the process of migrating from Beats, such as Filebeat and Metricbeat, to Elastic Agent, which is a unified solution for collecting logs, metrics, and providing security and threat prevention. Elastic Agent simplifies deployment and management by allowing users to configure a single agent policy instead of multiple configuration files for each Beat, offering centralized management through Kibana's Fleet, and providing endpoint protection. However, migrating to Elastic Agent involves certain limitations, such as the inability to configure the internal queue of Beats and the need to adapt existing configurations and custom dashboards for the new system. The document outlines steps for preparing and executing the migration, including setting up Fleet Server, deploying Elastic Agent, creating and managing agent policies, and eventually removing Beats to avoid redundant data and save storage space. The transition also involves adapting index lifecycle policies and potentially using index aliases to maintain custom dashboards while ensuring data streams are managed efficiently.

Elastic is dedicated to ensuring its product suite, including Kibana, is accessible to all users, particularly those with disabilities, by adhering to global accessibility standards such as the WCAG 2.2 and aligning with legal requirements in the United States and the European Union. The company is proactively auditing its products and publishing Voluntary Product Accessibility Templates (VPATs) to align with U.S. and EU requirements while implementing measures like maintaining an accessible component library and providing staff training. Despite only partially conforming to WCAG 2.2 Level AA, Elastic is committed to surpassing regulatory minimums through inclusive design and user experiences, integrating accessibility testing into various stages of its development lifecycle, and actively addressing limitations in charts, maps, and tables. Between 2024 and 2025, Elastic resolved over 1,800 accessibility issues and continues to audit and remediate issues, inviting user feedback to further enhance its accessibility efforts.

Elastic's 2025–2026 Partner Awards, celebrated during the Elastic{ON} Tour and ENGAGE summit, recognize global partners for their significant contributions to leveraging the Elastic Search AI Platform. The awards highlight achievements in seven global categories, including Top Sourced Revenue Partner and Top GenAI Partner, with additional local categories to honor unique regional contributions. The awards season kicked off in Bengaluru, with recipients like Ashnik Technology and Tata Consultancy Services being recognized, and will continue across cities like New York, Amsterdam, and Munich, extending into 2026 with events in Paris, London, and Tokyo, among others. These accolades underscore the pivotal role of partners in advancing AI, cloud, and data innovations with Elastic, with ongoing updates on winners being shared throughout the season.

The 2025 SIEM buyer's guide emphasizes the importance of selecting a Security Information and Event Management (SIEM) system that is equipped for the AI era, addressing the vital role SIEMs play in contemporary Security Operations Centers (SOCs). The guide provides insights into crucial features and questions to consider when engaging with vendors, aiming to ensure that organizations choose a solution that will strengthen their security programs long-term. It raises considerations such as the impact of cloud transformation on visibility, the time required for developing custom data integrations, and strategies to minimize vendor lock-in. The guide also includes additional resources, such as Elastic Security for SIEM and security analytics, to aid in modernizing and optimizing security operations.

Elastic has been awarded the 2025 Best Use of AI for Assisted Support by SupportLogic in the Support Experience AI Awards, recognizing its innovative integration of AI into customer and agent workflows. The award highlights the impact of Elastic's AI-powered Support Assistant, which has been built on the company's Search AI Platform to enhance digital self-service and improve response times. Since its launch, Elastic has seen a 49% growth in digital support usage, a 6x increase in case deflection, a 130% rise in knowledge article creation, and a 23% improvement in response times. The Support Assistant allows support engineers to focus on complex tasks by providing efficient solutions to customer queries, demonstrating AI's potential to transform assisted support into a strategic advantage for businesses. Elastic plans to continue expanding its AI-driven capabilities to further improve customer experiences and operational efficiency.

In a move to position Singapore as an AI-first nation, Prime Minister Lawrence Wong announced during the 2025 National Day Rally a renewed focus on empowering workers with AI skills and integrating AI into business processes. AI Singapore has been at the forefront of this initiative, delivering over 200 projects, including an AI-powered orthopantomogram scanner that significantly reduces dental assessment time. In collaboration with Elastic, AI Singapore organized a workshop to develop a pipeline of AI developers and showcase practical applications, emphasizing the importance of skills in driving AI success. The workshop featured insights into large language model prompt engineering and Elastic's Search AI capabilities, demonstrating the application of techniques like retrieval augmented generation to improve search relevance. As Singapore ranks second globally in AI-readiness, efforts are underway to establish AI hubs and centers of excellence, focusing on governance, innovation, and talent development. Laurence Liew from AI Singapore and Sanjay Deshmukh from Elastic highlighted the need for accurate data, data privacy, and skill development to operationalize AI effectively. Elastic remains committed to equipping developers with the tools and skills to harness AI for solving business challenges.

Elastic Security demonstrated exceptional performance in the AV-Comparatives EPR Test 2025, achieving a 99.3% detection rate in both Active and Passive Response methods, highlighting its robust capabilities against various attack vectors. The EPR Test, recognized for its rigorous evaluation standards, simulates complex attack scenarios across the full kill chain and evaluates solutions against the MITRE ATT&CK framework. Elastic Security's high scores reflect its ability to prevent threats effectively, minimize false positives, and maintain operational efficiency without disrupting workflows. The test results suggest a balanced total cost of ownership, emphasizing the long-term value of Elastic Security's comprehensive protection approach, which spans initial compromise, propagation, and asset breach phases. These outcomes reinforce Elastic Security's position as a leading solution in endpoint prevention, detection, and response, offering enterprises reliable protection without sacrificing usability.

Elastic Cloud Serverless has expanded its availability on Google Cloud by adding three new US regions, effectively doubling its regional presence and enhancing serverless deployment options. This service, based on the Search AI Lake architecture, leverages Google Cloud Storage to provide fast and scalable solutions for observability, security, and search without requiring infrastructure management. Elastic Cloud Serverless offers automatic scaling to handle varying workloads, low-latency querying, and a usage-based pricing model with no upfront costs. Starting September 12, 2025, it guarantees 99.95% uptime for Platinum and Enterprise subscribers, and it can be easily accessed via the Google Cloud Marketplace. Elastic plans to further extend its reach and introduce additional features to improve performance and usability, highlighting its commitment to advancing the future of data management without compromising speed, scale, or cost.

Version 9.1.4 of the Elastic Stack has been released, and users are encouraged to upgrade from the previous version, 9.1.3. For detailed information on the issues addressed and a comprehensive list of changes for each product in this version, users should consult the release notes.

Version 8.19.4 of the Elastic Stack has been released, and users are encouraged to upgrade to this latest version over 8.19.3. The update includes various fixes and changes, and detailed information on these modifications can be found in the release notes.

Elastic addresses the threat posed by the Shai-Hulud worm, which has compromised numerous npm packages, by implementing a series of proactive security measures to protect its software supply chain. Despite not finding any evidence of compromise within its systems, Elastic has audited its dependencies, disabled updates to its npm JavaScript repository, and temporarily halted auto-updating of JavaScript dependencies. Continuous endpoint scanning using OSQuery and out-of-the-box detection rules from Elastic Security Labs have been employed to identify any compromised packages. Additionally, Elastic has advised its developers of the situation and recommended security measures to its customers, emphasizing its commitment to maintaining security through continuous monitoring, rapid response, and transparent communication.

Elastic and Gigamon's partnership is enhancing Zero Trust Networking (ZTN) by leveraging Elastic's data processing capabilities and Gigamon AMI's enriched telemetry to transform raw network data into actionable security intelligence. This collaboration supports a security model where every network interaction is continuously verified, addressing the limitations of traditional perimeter-based security strategies. Elastic's architecture enables real-time data ingestion, enrichment, and lifecycle management, turning network telemetry into a comprehensive security knowledge base that aids in anomaly detection, continuous policy validation, lateral movement detection, threat hunting, and compliance. By combining Elastic's scalable intelligence engine with Gigamon AMI's context-rich metadata, organizations can achieve advanced threat detection and response, ensuring that their security posture is both proactive and adaptive in the face of evolving cyber threats. This approach underscores the shift from viewing security as merely a defensive measure to treating it as a data-centered problem requiring visibility, intelligence, and scalability.

Version 9.0.7 of the Elastic Stack has been released, and users are encouraged to upgrade from the previous version 9.0.6. This release addresses various issues and includes several changes across different products within the stack. For comprehensive details on the specific fixes and updates, users are advised to consult the release notes.

Version 8.18.7 of the Elastic Stack was released on September 17, 2025, with recommendations for users to upgrade from previous versions, particularly 8.18.6. The release notes provide detailed information on the issues that were fixed and the full list of changes for each product included in this new version.

Amid rising cyber threats, the Ministry of Defence (MOD) faces significant pressure to improve its cyber defenses, highlighting the need for faster threat detection and response times. Elastic Security offers AI-powered solutions to enhance defense Security Operations Centers (SOCs) by automating processes, reducing manual workload, and improving threat visibility and response times. Through tools like Elastic AI Assistant and Attack Discovery, SOCs can achieve substantial improvements in metrics such as mean time to detect (MTTD) and mean time to respond (MTTR). These tools prioritize genuine threats, streamline investigation workflows, and align with the MITRE ATT&CK framework to manage both known and novel attack methods. By integrating AI and machine learning, Elastic Security aims to alleviate analyst fatigue, minimize tool sprawl, and maintain mission readiness for defense teams.

Elastic Defend has introduced day-one support for macOS Tahoe 26, ensuring seamless endpoint protection and visibility for organizations upgrading to Apple's latest operating system. This immediate compatibility eliminates security gaps and maintains comprehensive coverage across Windows, Linux, and macOS environments. The integration supports system extension approvals, network content filtering, and full disk access, facilitating streamlined deployment via mobile device management (MDM). With built-in macOS rules, machine learning jobs, and threat intelligence integrations, Elastic Defend provides a unified view of endpoint activity, enhancing the security operations center's capabilities. Elastic's commitment to providing proactive security solutions ensures that organizations can confidently adopt new technologies without compromising protection against threats.

Tetragon's migration to Elastic Cloud Serverless is part of a broader strategy to enhance performance and foster growth in the AI industry, illustrating the company's commitment to innovation. Elastic has been actively expanding its offerings, with notable advancements such as the integration of Elastic Cloud Serverless on Microsoft Azure and its designation as an AWS Zero Trust partner. The company has also been recognized for its architectural advancements with AI, winning the 2025 Google Cloud DORA Award. Elastic's collaboration with NVIDIA to integrate GPU acceleration into Elasticsearch highlights its focus on improving performance and observability. Additionally, Elastic's AI capabilities are transforming public sector outcomes with GenAI on AWS and assisting financial institutions like SWIFT in modernizing payment infrastructures. Elastic continues to support diverse industries by advancing their IT systems, enhancing observability, and providing AI-driven solutions.

As industries and governments increasingly integrate large language models (LLMs) and generative AI into their operations, they face new security challenges that traditional measures cannot adequately address. The Open Web Application Security Project (OWASP) has created the OWASP Top 10 for LLM Applications as a framework to navigate these risks, emphasizing the need for a unified platform combining security, observability, and data management. Elastic's Search AI Platform provides a comprehensive solution by offering deep observability and security analytics across the entire LLM application stack, from user prompts to backend infrastructure. Utilizing tools such as Elastic Security and Elastic Observability, the platform addresses vulnerabilities such as prompt injection, sensitive information disclosure, and data poisoning by correlating signals across various layers and leveraging machine learning and prebuilt detection rules. This integrated approach allows organizations to confidently innovate with AI while managing risks effectively, as outlined in the OWASP Top 10 for LLMs.

Eduard van Mierlo's blog post discusses five strategic concepts for enhancing trust in government digital strategies using Elastic, aligning with the Netherlands' Digital Strategy and similar frameworks across Europe. These concepts include embracing open source and open standards, developing sovereign infrastructure, implementing responsible AI, strengthening cybersecurity and resilience, and fostering data-driven governance. Elastic's open-source approach is emphasized as a means to build community collaboration and transparency, while its flexible deployment options support sovereign infrastructures amid shifting political climates. The platform's responsible AI capabilities focus on transparency and data protection, crucial for public organizations dealing with AI and machine learning. Elastic Security offers comprehensive SIEM, XDR, and cloud security solutions, allowing public sector entities to minimize risk exposure and control costs effectively. The data-driven government initiative leverages Elastic's tools for observability, security, and search, underpinned by open standards to ensure data availability and security.

AI-driven threat detection and response leverages technologies such as machine learning and natural language processing to enhance cybersecurity operations by automating complex tasks, reducing alert fatigue, and providing real-time insights. Despite the high failure rate of AI projects, its successful application in cybersecurity is crucial for managing advanced threats, which are increasingly using AI themselves. AI excels in processing large volumes of data, recognizing patterns, and supporting real-time decisions, thus improving threat detection by reducing false positives and enhancing the scalability of security operations. It also transforms incident response by automating repetitive tasks, enriching alerts with contextual data, and guiding analysts through workflows, which accelerates response times and increases consistency without additional staffing. Moreover, AI can ingest and analyze data efficiently, which is essential for maximizing detection and response capabilities, ultimately allowing security teams to focus on priority incidents and reduce the operational drag of noise.

AI-driven threat detection and response enhances cybersecurity operations by leveraging machine learning models, large language models, and natural language processing to automate complex tasks and deliver real-time insights, thus improving the speed and accuracy of threat identification and mitigation. These technologies excel in high-volume data processing, pattern recognition, and supporting real-time decisions, proving particularly effective in threat detection, incident response, and alert triage. However, tasks requiring strategic judgment and deep business context still benefit from human expertise. AI reduces alert fatigue, enhances incident response by automating repetitive tasks, and enriches alerts with actionable context, empowering security teams to respond swiftly and effectively without increasing headcount. This advancement allows security operations centers to scale more efficiently while maintaining focus on high-priority threats and enhancing overall cyber resilience.

In October 2024, Elastic inadvertently made their most critical public GitHub repositories private, causing a significant service disruption for their customers and open-source users. The incident occurred during an effort to enhance internal source code security by migrating repositories from internal to private visibility. However, a lack of validation in their automation scripts led to 63 public repositories, including Elasticsearch and Kibana, being incorrectly marked as private. The incident highlighted the importance of verifying real-world states before executing automated changes, breaking down large-scale changes into smaller iterations, and decentralizing authority for sensitive actions. Elastic's well-practiced incident management process, collaboration with GitHub, and a blameless culture played crucial roles in resolving the issue within seven hours and restoring the repositories' visibility. The incident prompted Elastic to implement stricter access controls and inventory management to prevent similar occurrences in the future.

Elastic has been featured in the AWS Generative AI Content Hub for the public sector, highlighting its role in transforming public sector organizations using embedded Generative AI (GenAI) on Elastic Cloud via AWS. This integration aims to enhance mission outcomes by incorporating AI-powered search, retrieval augmented generation (RAG), and automated security workflows into existing systems. Elastic's approach promises quick, measurable results, offering smarter, context-aware search capabilities and a democratized data foundation for IT monitoring and security operations. The platform is designed to meet public sector requirements with native integration with Amazon Bedrock for access to leading large language models (LLMs) and compliance with FedRAMP-authorized standards. A case study of Georgia State University illustrates the practical impact of Elastic's solutions, where the university improved its financial aid process, leading to better student retention and graduation rates. The AWS Generative AI Content Hub serves as a resource for public sector leaders to facilitate the transition from small-scale pilots to full-scale GenAI adoption with proven solutions, although Elastic notes that the availability of features remains at its discretion.

On August 26, 2025, Salesloft Drift disclosed a security incident, prompting Elastic to activate its incident response protocols due to using Drift for certain business applications. Elastic's investigation confirmed that its Salesforce environment was unaffected but identified that a single email account linked to the Drift Email integration had been compromised, potentially allowing unauthorized read-only access to emails containing valid credentials. Elastic promptly notified affected customers and took immediate action by disabling Drift integrations, reviewing access logs, and coordinating with vendors to assess the incident's scope further. Elastic remains dedicated to transparency and data protection, continuing to monitor developments and pledging to update stakeholders as more information becomes available.