Tag: Vulnerability
-
Your AI Agent Is Not an Employee. Stop Giving It Employee Access.
Businesses are handing email accounts, terminals, GitHub access and payment permissions to AI agents that hallucinate, get prompt injected and follow anyone who knows the right words. An agent is not an employee. It is an untrusted service account, and it should be treated like one.
-
The Quiet Death of ‘Just Send Me the File’
Every business, every day, has the conversation that ends with ‘just send me the file.’ The way the file moves has not changed in 30 years. That is starting to change, slowly.
-
Why Your VPN Is About to Get Weird
The corporate VPN is the longest-running piece of security theater in tech. It is being replaced, slowly, by a stack of small ideas that happen to work better now than they did five years ago.
-
Small Business Actually Secure in 2026
Small business security in 2026 amounts to the security work the typical 10-50 person company has to do without the budget of the Fortune 500. The work is not impossible, the work runs as the work the security vendors do not sell to the small business, the work amounts to the work the small business…
-
The CISO Handbook: The Second Edition
The first edition sold the idea that the CISO could be a peer to the CIO. The second edition quietly walks that back. The role has shifted, the board has shifted, the threat has shifted, and the playbook that worked in 2020 does not work in 2026.
-
Lateral Movement Without Exploits in 2026
Lateral movement without exploits in 2026 amounts to the dominant attack pattern in the typical enterprise breach. The attacker compromises one endpoint with a phishing email, the attacker uses the legitimate credentials the phishing email captured, the attacker moves to the next endpoint with the legitimate credentials, the attacker does not need a single exploit…
-
The Tools We Actually Use to Read a Site’s Security Posture
An afternoon and five free open source tools is enough to read the public security posture of almost any website. Here is the kit we use, in the order we use it, and what it does and does not show.
-
Inside a Modern Ransomware Attack
Modern ransomware is not a virus. It is a business process. The attackers run it like a company, with departments, SLAs, and customer support for the victims.
-
The 3 2 1 1 0 Backup Strategy Explained
The 3-2-1 backup strategy has been the industry standard for so long that the new variant (the 3-2-1-1-0) sounds like a typo. It is not. The extra numbers serve as the answer to the ransomware variant that the 3-2-1 was not designed to handle.
-
Small Business Security: 25 Things You Can Fix This Weekend
You do not need a CISO, a six-figure security budget, or a vendor pitch deck to dramatically improve your company’s security posture. You need a weekend, a checklist, and the discipline to actually finish the list.