Category: Cybersecurity

  • Why Your Vulnerability Scanner Is Missing the Vulnerabilities That Matter

    Why Your Vulnerability Scanner Is Missing the Vulnerabilities That Matter

    ~ 5 MIN READ

    The vulnerability scanner is good at finding known CVEs. It is not good at finding the vulnerabilities that lead to breaches, which are misconfigurations, exposed credentials, over privileged identities, exposed secrets, and custom code. The scanner is a compliance tool that produces a 200 page report nobody reads. The actual security work is somewhere else.

  • How to Actually Do Zero Trust Without the Cost in 2026

    How to Actually Do Zero Trust Without the Cost in 2026

    ~ 5 MIN READ

    The Zero Trust the enterprise has been told to adopt has been sold as the platform the enterprise has to buy, the platform that costs more than the security budget can afford, the platform the CISO has been quietly writing off as the unreachable goal.

  • The Browser Password Autofill Is the Weakest Link in Your Security Stack

    The Browser Password Autofill Is the Weakest Link in Your Security Stack

    ~ 5 MIN READ

    The browser based password manager is, in 2026, the least secure password manager you can use. The autofill is the credential capture vector. The dedicated managers are better. The passkeys are best of all.

  • The Security Industry Has an Incident Response Problem

    The Security Industry Has an Incident Response Problem

    ~ 5 MIN READ

    When a company gets breached, the first call is to an incident response firm. The firm shows up, runs the playbook, contains the breach, writes a report, hands it to legal, leaves. The next breach finds the same gaps, the same mistakes, the same recommendations ignored.

  • Building a Detect and Respond Team in 2026

    Building a Detect and Respond Team in 2026

    ~ 5 MIN READ

    The detect and respond team the enterprise has been building has finally become the team the breach response depends on, the team the executive team has been quietly asking for, the team the CISO has been struggling to staff.

  • A Field Guide to the Cryptographic Inventory in 2026

    A Field Guide to the Cryptographic Inventory in 2026

    ~ 5 MIN READ

    The cryptographic inventory has become the inventory the security team has been quietly dreading, the inventory the post quantum deadline is forcing the security team to build, the inventory the auditor has been asking for.

  • Why Your MFA Gets Bypassed Anyway

    Why Your MFA Gets Bypassed Anyway

    ~ 5 MIN READ

    Multi factor authentication is the single most effective security control most organisations have ever deployed. It is also, in 2026, the security control most often bypassed in production attacks. The reason is that the threat model MFA was designed for is not the threat model the attacker uses today.

  • The CISO and the Pre IPO Audit in 2026

    The CISO and the Pre IPO Audit in 2026

    ~ 5 MIN READ

    The CISO and the pre IPO audit has become the audit the CISO has been quietly trying to prepare for, the audit the underwriter has been quietly demanding, the audit the security team has been quietly trying to survive.

  • Your Password Manager Is Now Your Most Valuable Target

    Your Password Manager Is Now Your Most Valuable Target

    ~ 5 MIN READ

    Every password manager breach in the last 5 years has confirmed the same thing. The vault is the target. Master password strength is now the only thing standing between your entire digital life and the attacker.

  • The Browser Has Become the New Operating System. The Security Model Is From 2009.

    The Browser Has Become the New Operating System. The Security Model Is From 2009.

    ~ 5 MIN READ

    For most office workers in 2026, the browser is the operating system. The security model of the browser is from 2009. That gap is the attack surface, and the attack surface is where the next wave of breaches will live.