Tag: Phishing
-
What an Honest Security Audit Looks Like
An honest security audit in 2026 looks different from a checkbox security audit. The checkbox audit serves as a list of controls the auditor has to verify, with the auditor checking the box, the enterprise moving on. The honest audit stands as a process of finding the things the enterprise does not want found.
-
The Phishing Email That Works in 2026 (And Why Your Filters Won’t Save You)
Phishing has not improved because filters got worse. It has improved because attackers can produce clean, context-aware messages, imitate legitimate login flows, proxy sessions, and exploit normal human urgency.
-
Hiring a Security Expert Is Not Going to Save You
The organisation that hired the CISO at twice the market rate and gave them a year to fix the security program is the organisation whose security posture is the same. Here is why the single hire does not work, and what does.
-
Why Your MFA Push Notifications Are a Security Hole
The MFA push notification in 2026 sits as the security control the typical enterprise has deployed to replace the password, with the push notification promising the security the password cannot provide. The 2026 reality amounts to the reality where the push notification has become the attack vector the attacker uses, with the MFA fatigue attack,…
-
What Cybersecurity Insurance Actually Buys You
Cybersecurity insurance in 2026 amounts to a $20B annual market, with the typical enterprise paying $50K-$500K per year for the coverage, with the coverage paying out roughly 40% of the time the enterprise has a claim, with the payout typically running at 30-50% of the claim. The insurance buys the enterprise some financial protection, the…
-
The Phishing Test Everyone Failed
A simulated phishing email sent to every employee at a mid sized company, the email was a fake package delivery notification, the link went to a fake login page. The click rate was 17 percent. The interesting part is who clicked.
-
What Happens When Your Vendor Gets Breached
What happens when your vendor gets breached, in 2026, is that you find out about it from the press, your CISO gets paged at 2 AM, the incident response plan turns out to not match the actual scenario, and the next 72 hours are spent trying to figure out what data the vendor had on…
-
The People Who Run Your Systems Don’t Trust Your Vendors
The people who actually run production systems, the ones who carry a pager and answer the 2 AM page, do not trust the vendors they buy software from. The trust gap is not new, but it has gotten wider in the last three years.
-
The Browser Has Become the Operating System. The Security Model Is From 2009.
For most office workers in 2026, the browser is the operating system. The security model of the browser was designed for a world where the browser was a document viewer, not the place where your work happens, and the gap is the attack surface.