Lumen Extends Black Lotus Labs Threat Intelligence to AWS Network Firewall, Delivering Proactive Protection

In an era when cyberattacks move faster than traditional defenses, Lumen Technologies is taking proactive cloud protection upstream. As the trusted network for AI, the company announced Lumen Defender Managed Rules for AWS Network Firewall, now available in AWS Marketplace making the same threat intelligence that safeguards Lumen’s network directly accessible to AWS customers. By extending Black Lotus Labs’ upstream threat intelligence into AWS Network Firewall, enterprises can detect and block threats before they cause harm and without adding infrastructure or complexity.

“As cyber threats grow more automated and distributed, organizations need visibility that reaches beyond their own perimeter,” said Martin Nystrom, Vice President of Black Lotus Labs and Product Security at Lumen. “Because Lumen operates one of the world’s most deeply connected global networks, our Defender threat intelligence delivers an upstream view into malicious infrastructure before it targets customers. By integrating this intelligence directly into AWS Network Firewall, we enable earlier detection and disruption of botnets, malware, and nation-state activity—helping organizations strengthen their defenses at the network edge.”

Now Available on AWS Marketplace

Lumen Defender Managed Rules is available as a Managed Rule group for AWS Network Firewall on AWS Marketplace. Customers can subscribe to the rule group and automatically apply it to their firewalls from AWS Network Firewall console. With this rule group, customers gain access to Black Lotus Labs’ threat intelligence, allowing rapid integration of threat data to protect critical cloud deployments.

Proactive defense for the AI-era threat landscape

Many security tools, like firewalls, endpoints, and cloud security, detect threats at the brink of intrusion, with defense happening after the attack has already penetrated network defenses.

Additionally, these security tools typically lack visibility into external threat infrastructure, delaying identification of emerging attacks, and increasing risk to enterprise assets, customer data, and operational continuity.

Also Read: CIO Influence Interview with Duncan Greatwood, CEO at Xage Security

For organizations to make the shift from reactive to proactive defense they require:

• Visibility: Insight across the global threat landscape, not just internal infrastructure.
• Timeliness: Intelligence that enables action before breach activity occurs.
• Fidelity: High-confidence signals that minimize false positives and drive focused response.
• Context: Actionable insights about indicators of compromise, helping security teams understand threat type, severity, and confidence.

Lumen Defender Managed Rules for AWS Network Firewall is designed to meet these requirements—delivering backbone-powered threat intelligence, rapid updates, and actionable context to help organizations stay ahead of emerging threats.

Expert-led threat intelligence

Black Lotus Labs, Lumen’s threat research arm, delivers high-level network visibility into global internet traffic—processing over 200 billion NetFlow sessions daily from the global IP backbone. Its seasoned research team leverages malware reverse engineering, AI/ML-driven anomaly detection, and botnet infrastructure mapping, to uncover and disrupt threats before they reach customer environments. This intelligence has powered takedowns of advanced persistent threats and criminal proxy networks and is now available to integrate directly into AWS Network Firewall through Defender Managed Rules.

Lumen Defender Managed Rules for AWS Network Firewall enables customers to:

• Block threats earlier in the kill chain, using curated rules derived from Lumen’s backbone-level visibility, and delivering protection that sees beyond traditional perimeter defenses.
• Accelerate deployment and reduce overhead with continuously updated rules, delivered via AWS.
• Act with confidence, using enriched indicators that include severity, threat categories, minimizing false positives, and enabling focused response.