Category: Cybersecurity

  • The Browser Password Autofill Is the Weakest Link in Your Security Stack

    The Browser Password Autofill Is the Weakest Link in Your Security Stack

    ~ 5 MIN READ

    The browser based password manager is, in 2026, the least secure password manager you can use. The autofill is the credential capture vector. The dedicated managers are better. The passkeys are best of all.

  • The Security Industry Has an Incident Response Problem

    The Security Industry Has an Incident Response Problem

    ~ 5 MIN READ

    When a company gets breached, the first call is to an incident response firm. The firm shows up, runs the playbook, contains the breach, writes a report, hands it to legal, leaves. The next breach finds the same gaps, the same mistakes, the same recommendations ignored.

  • Building a Detect and Respond Team in 2026

    Building a Detect and Respond Team in 2026

    ~ 5 MIN READ

    The detect and respond team the enterprise has been building has finally become the team the breach response depends on, the team the executive team has been quietly asking for, the team the CISO has been struggling to staff.

  • A Field Guide to the Cryptographic Inventory in 2026

    A Field Guide to the Cryptographic Inventory in 2026

    ~ 5 MIN READ

    The cryptographic inventory has become the inventory the security team has been quietly dreading, the inventory the post quantum deadline is forcing the security team to build, the inventory the auditor has been asking for.

  • Why Your MFA Gets Bypassed Anyway

    Why Your MFA Gets Bypassed Anyway

    ~ 5 MIN READ

    Multi factor authentication is the single most effective security control most organisations have ever deployed. It is also, in 2026, the security control most often bypassed in production attacks. The reason is that the threat model MFA was designed for is not the threat model the attacker uses today.

  • The CISO and the Pre IPO Audit in 2026

    The CISO and the Pre IPO Audit in 2026

    ~ 5 MIN READ

    The CISO and the pre IPO audit has become the audit the CISO has been quietly trying to prepare for, the audit the underwriter has been quietly demanding, the audit the security team has been quietly trying to survive.

  • Your Password Manager Is Now Your Most Valuable Target

    Your Password Manager Is Now Your Most Valuable Target

    ~ 5 MIN READ

    Every password manager breach in the last 5 years has confirmed the same thing. The vault is the target. Master password strength is now the only thing standing between your entire digital life and the attacker.

  • The Browser Has Become the New Operating System. The Security Model Is From 2009.

    The Browser Has Become the New Operating System. The Security Model Is From 2009.

    ~ 5 MIN READ

    For most office workers in 2026, the browser is the operating system. The security model of the browser is from 2009. That gap is the attack surface, and the attack surface is where the next wave of breaches will live.

  • The accidental insider: when your own AI agent causes a breach

    The accidental insider: when your own AI agent causes a breach

    ~ 5 MIN READ

    The dominant breach pattern of 2026 is not the external attacker. It is the autonomous agent, internal, with credentials, acting on its own. The pattern has a name now, and the playbook for defending against it is taking shape.

  • The post-quantum migration: who has actually moved in 2026, and what broke

    The post-quantum migration: who has actually moved in 2026, and what broke

    ~ 5 MIN READ

    Two years after NIST finalised the first post-quantum standards, the migration that everyone agreed was urgent has, in most places, not happened. Here is what shipped, what is stuck, and what a defensible end of year position looks like.