---
title: BeyondTrust: its detection platform's automated triage closed the real privilege-escalation alerts as false positives | ctxsec
url: https://ctxsec.com/items/industry-beyondtrust-auto-triage-lesson
description: ""
status: "vendor account"
published: 2026-10-15
---

> 

[← Industry News](/industry) · [markdown](/items/industry-beyondtrust-auto-triage-lesson.md)

vendor account

2026-10-15

### BeyondTrust: its detection platform's automated triage closed the real privilege-escalation alerts as false positives

In its BT26-05 post, BeyondTrust says its sensors fired in real time when the attacker escalated privileges on a hosted Remote Support instance, but the built-in triage tool in its third-party detection platform closed those alerts as false positives. The intrusion was found instead on Sept 28 by an intel-driven hunt queued after another edge-vendor zero-day went public, and contained 27 minutes after it was identified. BeyondTrust says it's working with the vendor so automated triage can't close high-severity signals on its own, and recommends treating a triage verdict as one input and keeping closed alerts in scope for hunts. Separately, it says it assesses (without forensic proof) that the actor keeps product models in an AI context to build exploit chains; that part is the vendor's assessment.

Sources: [BeyondTrust blog: ARMORY CASTLE and BT26-05](https://www.beyondtrust.com/blog/entry/bt26-05)