Blog
What's new in hands-on cybersecurity
Straight talk on incident response, cloud and identity, and the security risks worth fixing first.
Start here
Featured
The first 72 hours of an incident, hour by hour
Most of the damage in a breach is decided before anyone knows how bad it is. Here is what the first three days should look like, and the decisions that matter most in each block of hours.
Shadow AI is already in your company
Your staff are pasting contracts, code and customer data into AI tools today, whether or not you have a policy. A practical way to say yes safely instead of pretending you can say no.
Ransomware-ready: backups that actually restore
Almost every company we meet has backups. Far fewer have tested getting a whole business back from them while an attacker is still deleting things. Here is how to close that gap.
All articles
latest articles
The CEO on the phone is not the CEO
Voice cloning has turned the classic payment scam into a phone call that sounds exactly like your boss. The fix is not better ears. It is a payment process that does not trust voices at all.
Your CI pipeline is the new perimeter
Attackers have stopped knocking on the front door of production. They go through the build system instead, because it holds every secret and deploys everything. Six controls that close most of the gap.
The logs you will wish you had
In most investigations the question is not what the attacker did, but whether anyone recorded it. Six log sources that decide whether an incident takes days or weeks to understand.
Phishing in 2026: why the inbox still wins
Language models have made phishing emails flawless, and push-fatigue has made MFA bypassable. Training people to spot typos no longer works. What does, and how to measure it.
Your helpdesk is an identity provider
Some of the most damaging intrusions of the past few years started with a phone call to IT asking for an MFA reset. If the helpdesk can reset anything, it needs to verify like it means it.
Five cloud misconfigurations we keep finding
Cloud breaches rarely need a zero-day. They need a forgotten bucket, an over-trusted role or an admin key on a laptop. The five issues that show up again and again, and the quickest way to check for each.
Passkeys, not passwords: a rollout plan for a 50-person company
Passkeys stop the phishing attacks that MFA no longer stops, and people find them easier than passwords. The hard part is the rollout. A six-week plan with the edge cases nobody mentions.
When MFA passes and the attacker still gets in
Adversary-in-the-middle phishing kits steal the session, not the password. Your users complete MFA perfectly and hand over a logged-in browser. Here is how to make stolen sessions worthless.
SOC 2 without the theatre
An audit report can be earned two ways: by building controls you would keep anyway, or by producing screenshots for a few weeks a year. Only one of them makes you safer, and it is not much more work.
You pushed a secret. Now what?
Automated scanners find exposed keys in public repositories within minutes. Deleting the commit does not help. A calm, practical routine for the moment someone realises a credential has leaked.
Unmanaged laptops: the asset you forgot to count
Your cloud is inventoried and your code is scanned. The laptops that hold the keys to both often are not. How to find every device that touches company data, and bring it under management without a revolt.
The package you did not mean to install
Typosquats, hijacked maintainer accounts and malicious install scripts turn your dependency tree into an attack surface. Practical controls that do not slow developers to a crawl.
Who else has the keys to your cloud?
Service accounts, CI roles, third-party integrations and forgotten automation now outnumber human users in most cloud estates. Many of them have far more access than they need.
Your VPN is the new front door
Firewalls, VPN gateways and remote access appliances sit on the internet by design, and attackers have made them a priority. How to patch, watch and shrink the edge you expose.
Browse
Explore by topic
incident response
Breaches, ransomware and the first hours that decide what an incident costs.
LatestRansomware-ready: backups that actually restoreRead the topic 3 articlescode & delivery
Pipelines, dependencies and secrets: security in how software gets shipped.
LatestYour CI pipeline is the new perimeterRead the topic 2 articlescloud
Misconfigurations, identities nobody owns and keeping production locked down.
LatestFive cloud misconfigurations we keep findingRead the topic 2 articlespeople
Phishing, deepfakes and the human side of how attacks really start.
LatestThe CEO on the phone is not the CEORead the topic 3 articlesidentity
MFA, passkeys, sessions and the accounts attackers want most.
LatestYour helpdesk is an identity providerRead the topic 2 articlesgovernance
SOC 2, AI policy and compliance work that lowers real risk.
LatestShadow AI is already in your companyRead the topic 2 articlesdevices
Laptops, VPN gateways and the edge devices facing the internet.
LatestUnmanaged laptops: the asset you forgot to countRead the topicNewsletter
One email a month
New articles, plus the one thing from our incident queue that we would change first if we were you.