Cybersecurity in plain English.

Frontier AI Cleared Every Attack Goal in an OT Lab. What That Means for Your Plant

Booz Allen ran frontier AI models against an industrial control testbed. The models cleared all eight attack objectives and reached the control zone in 16 minutes. Here is what defenders should change.

AI Is Finding Your Vulnerabilities First — And Exploiting Them Within 4 Days

Google Threat Intelligence Group found that AI-discovered vulnerabilities are 50% likely to enable RCE, and attackers are exploiting them within days. Here's what your vulnerability management program needs to change.

A 9.8 Zero-Day Found by the Vendor Itself: What the FortiMail Flaw Teaches Us

Fortinet's internal team discovered a critical zero-day actively exploited in the wild. The discovery process and response timeline reveal lessons about vendor transparency and incident readiness.

Your MCP Server Just Decided Where You Log In: The OAuth Flaw to Fix This Week

The official MCP Python SDK sent client secrets and PKCE keys to whatever login server a remote MCP server pointed at. Fixes shipped in 1.30.0 and 2.2.0, and upgrading alone is not enough.

Patched Isn't Protected: The Shrinking Window Between Patch and Exploit

A SharePoint bug patched in August was under active attack within a week of details going public. Why your patching window is now measured in days, not months.

Unlocking Global Internet Insights: A Deep Dive into Cloudflare Radar

Discover how Cloudflare Radar provides free access to global internet traffic patterns, security intelligence, and technology trends.

Securing Web Applications, the “Free” Way

This article will walk you through free tools to help secure your custom applications.

Navigating Cybersecurity with SBOMs: Lessons from Log4J and MOVEit Incidents

My latest article delves into how Software Bill of Materials (SBOMs) can play a pivotal role in enhancing organizational security, especially in light of the recent Log4J and MOVEit attacks.

Deepening Your Understanding of Incident Response Plans and Effective Tabletop Simulations

Explore the essentials of Incident Response (IR) in our blog, tailored for businesses and cybersecurity professionals. Learn about IR plan components, legal compliance, team diversity, and effective communication strategies. Gain practical insights on conducting and improving Incident Response Tabletop Simulations. A vital read for enhancing your organization's cybersecurity preparedness and response capabilities.

Attack Surface Reduction in Cybersecurity: A Proactive Approach to Enhance Digital Safety

Explore Attack Surface Reduction (ASR) in cybersecurity. Learn its importance, practical strategies for businesses, and ways to mitigate common vulnerabilities for enhanced digital security. A must-read for anyone keen on proactive cyber defense.

Privileged Identity Management

This blog is about the benefits of PIM and how it can enable you to secure your organization's privileged roles.

Azure Software Development using Logic Apps and Azure Tables

Create an Instagram Data Aggregator using Azure and the Meta API that can be called and sorted without data sprawl.

The Human Aspect of Cybersecurity: Beyond the Technical Controls

This article highlights the importance of training your employees about potential threats and good tips to prevent you from falling victim to a social engineering attack.

The Imperative of Securing DNS Records: Safeguarding Your Organization from Threats

IoT Security: The Increasing Importance in 2023

What We Can Learn from SpaceX’s Supplier Schematics Leak

Let’s talk about how creating an SCRM program can further secure your business and protect the Intellectual Property of your business. I also add some tips to consider when creating your SCRM.

The Impact of Cybercrime on Small Businesses

Why cybersecurity should be a core part of every business, regardless of industry.

Best Practices for Creating Strong Passwords

Why forcing frequent password resets is a bad practice, and the risks that come with it.

The Importance of Cybersecurity Awareness and Education

Cybersecurity awareness and education are crucial to protecting individuals, businesses, and organizations from a growing number of cyberattacks.

Defense-in-Depth and Conditional Access

Blog talks about conditional access and how it provides defense-in-depth.

What Should an Annual Security Evaluation Entail?

Example of what should be involved in a annual security assessment.