dbt v2 cuts compute 15-30% with intelligent state reuse

---

dbt v2 ships with state reuse that cuts warehouse compute 15-30% through intelligent model diffing. The release unifies Core and Fusion into a single Rust engine and makes dbt State generally available. State compares SQL and warehouse metadata to skip, clone, or defer unchanged models automatically. RxBenefits reused 700k models and cut costs 59% over 60 days.

Meanwhile, Cloudflare's Page Shield ML caught eight client-side attacks that evaded VirusTotal and URLScan for years—one payload sat unclassified for 2.5 years.

In this issue:

• dbt v2: Rust engine, dbt State GA, 15-30% compute reduction
• Cloudflare Page Shield ML detects JavaScript threats missed by signature scanners
• Google Cloud M4N instances: 6TB RAM, 1M IOPS, 26:1 memory-to-vCPU ratios
• CISA guidance on cyber decoys for detecting lateral movement and LOTL techniques

---

dbt v2 Ships With State Reuse That Cuts Compute 15-30%

The Signal

dbt Labs shipped v2 with unified Rust engine and dbt State GA, cutting warehouse compute 15-30% through intelligent state reuse.

What Changed

• v2 unifies Core and Fusion into one Rust-based engine, parsing 10k-model projects 10x faster than v1
• https://docs.getdbt.com/blog/dbt-v2-is-ga
• dbt State compares SQL and warehouse metadata to skip, clone, or defer unchanged models automatically
• https://www.getdbt.com/blog/dbt-state-is-ga
• RxBenefits reused 700k models, saved two weeks query time and cut costs 59% over 60 days
• Works on Snowflake, BigQuery, Databricks, Redshift; requires dbt v1.7+ for State
• Pricing tied to daily active target tables (DATT), not compute or table size

Operational Impact

Teams running 22 million daily model builds can eliminate selection syntax and manifest scripting entirely. State reuse shifts orchestration from schedule-based to change-based execution using per-model `lag_tolerance` freshness declarations. Development iteration cycles drop from 15-25 minutes to seconds for large lineage chains. Consumption-based pricing means frequent runs cost the same as infrequent ones after first daily reuse.

Watch For

Adapter availability varies: BigQuery, Databricks, DuckDB, Redshift, Snowflake are GA; ClickHouse and Spark remain beta. Teams on Airflow, Dagster, or GitHub Actions will need to evaluate whether to refactor orchestration logic to leverage model-level freshness declarations instead of job-level scheduling.

---

Cloudflare ML Catches Client-Side Attacks That VirusTotal and URLScan Missed for Years

The Signal

Cloudflare Page Shield ML detected eight malicious JavaScript payloads targeting storefronts; seven were absent from VirusTotal, all received no classification from URLScan.

What Changed

• Page Shield uses graph neural network (GNN) analysis of JavaScript syntax trees, not hash signatures.
• Four campaigns detected: affiliate hijacking, clickless fraud, remote code backdoors, analytics tampering.
• One Lnkr family payload sat indexed by URLScan for 2.5 years with no verdict.
• Traditional scanners require known labels; ML analyzes execution patterns in real time.
• Seven of eight payloads were completely absent from VirusTotal when Page Shield flagged them.

Operational Impact

Teams running e-commerce storefronts and relying on VirusTotal or URLScan for client-side security have a significant blind spot. These scanners wait for hash labels or URL verdicts, while malicious JavaScript uses conditional execution gates (device type, time, geography, browser state) to stay dormant during scanner visits. One payload evaded classification for over two years while actively stealing affiliate commissions and manipulating search results on live retailer sites. Behavioral ML that analyzes how JavaScript executes — what it hooks, intercepts, hides, or fetches — catches threats that signature-based tools miss entirely.

Watch For

The four detected campaigns used different evasion techniques: MutationObserver hooks, invisible iframes, localStorage cooldowns, and 325-entry IP denylists. Attackers are building client-side threats that adapt based on runtime context, not static signatures.

---

Google Cloud M4N: 6TB RAM Instances Target Oracle Licensing Costs

The Signal

Google Cloud's M4N series (GA) delivers 6TB RAM, 1M IOPS, and 26:1 memory-to-vCPU ratios.

What Changed

• M4N provides up to 25 GiB/s aggregate storage throughput and 1M IOPS with Hyperdisk Extreme
• Memory scales to 5,952 GB DDR5 across 16-224 vCPU configurations with 26:1 ratio
• Built on 5th Gen Intel Xeon with Titanium offload for I/O performance
• Delivers 400 Gbps VM-to-VM bandwidth, 200 Gbps internet egress, and 48 MPPS packet processing
• Doubles block storage performance of M4 instances without Tier_1 networking add-ons

Operational Impact

Teams running Oracle or SAP can now right-size vCPU counts without sacrificing memory or I/O capacity. This directly reduces per-core licensing fees—Google claims 20% TCO reduction for Oracle workloads. The higher memory-to-vCPU ratio lets database administrators provision fewer cores while maintaining large SGA sizes and high cache-hit ratios. For workloads like Oracle RAC, SAP HANA, or SQL Server clusters, M4N eliminates the historical trade-off between compute over-provisioning and storage bandwidth.

Watch For

M4N availability is limited to select regions at launch. Peak storage performance requires pairing with Hyperdisk Extreme—standard persistent disks will bottleneck at lower thresholds.

---

CISA Publishes Operational Guide to Cyber Decoys for Detection and Response

The Signal

CISA released guidance on implementing cyber decoys to detect adversaries using legitimate credentials and LOTL techniques.

What Changed

• Document covers tripwires, breadcrumbs, and honeytokens for post-compromise detection.
• Maps decoy strategies to MITRE Engage and MITRE ATT&CK frameworks.
• Provides implementation steps for teams at varying cybersecurity maturity levels.
• Addresses detection gaps for lateral movement and discovery using native tools.
• Full guidance available as PDF from CISA.

Operational Impact

Decoys complement Zero Trust by creating high-fidelity alerts when adversaries interact with fake assets. Teams struggling with alert fatigue or lacking visibility into LOTL activity gain a detection layer that assumes breach. Implementation requires placement planning and monitoring integration but offers low-complexity entry points for organizations without mature threat hunting.

Watch For

Adoption will depend on integration with existing SIEM and EDR tooling. CISA's ATT&CK mapping may drive decoy deployment aligned with specific threat models.

---

Quick Reads

• dbt Labs — v2 ships with state reuse cutting warehouse compute costs by 15-30%.
• Cloudflare — Page Shield ML detected eight malicious JavaScript payloads missed by VirusTotal and URLScan.
• Google Cloud — M4N instances offer 6TB RAM with 26:1 memory-to-vCPU ratios for Oracle workloads.
• CISA — Published operational guidance on using cyber decoys for post-compromise detection and response.