Tag: Phishing
-
Why SSO Isn’t Magic and Your Service Account Problem Is Worse
Single sign on solved the human password problem. It did not solve the service account problem. The service account problem is now larger than the human password problem was in 2015.
-
Modern Phishing as a Service Is Boring (And That Is Why It Works)
Phishing in 2026 is not a clever technical exploit. Phishing in 2026 is a service industry, a well oiled business, and the most reliable way into a corporate network. Here is why it works.
-
A Field Guide to Securing the IT Help Desk
The IT help desk has become the primary attack surface for the social engineering threat. The attacker calls, pretends to be an employee, and walks the operator through a password reset. Here is how to stop it.
-
How to Spot a Vendor That Is About to Get Acquired
The vendor the enterprise relies on just got acquired. The product roadmap is now the acquirer’s product roadmap, the support contract is now the acquirer’s support contract, the data the enterprise shared with the vendor is now the acquirer’s data. The acquisition has happened before the enterprise knew it was happening.
-
The Postman Problem and Why Your API Will Get Breached
Every API gets breached the same way. The attacker does not break the API. The API breaks itself, and the developer who built it learns about it from the breach disclosure.
-
Your Attack Surface Is Bigger Than You Think
The attack surface the security team has been defending is a fraction of the actual surface. The asset the security team knows about, the system the security team has patched, the application the security team has tested, the surface that the attacker does not even bother with because the attacker has found something the security…
-
What an Honest Vendor Demo Looks Like
The vendor demo has become the polished thirty minutes the vendor uses to sell the procurement team on the tool the vendor has spent six months building. The demo that shows the tool working in the conditions the demo was designed to handle, the conditions the enterprise environment does not match.
-
Why Your Incident Response Runbook Is Wrong
The incident response runbook the security team has been quietly polishing sits as the runbook the next breach will reveal as the runbook that was written for the wrong breach, the wrong team, the wrong moment.
-
Security Tooling in 2026 Is Bigger Than Ever, and About the Same
A field guide to the security tooling market in 2026, with the consolidation, the categories that are over funded, the categories that are under funded, and the part about the dashboard that is going to get ignored.
-
When AI Hallucinates in Production
The failure looks like a confident answer that is wrong in a way the system cannot detect, and the cannot detect is the part the production team has to live with.