17 min read
Everything You Ever Wanted to Know About Content Security Policy
CSP is a powerful XSS defense that is routinely misconfigured. How it works, a strict 2026 policy, and the bypasses you will actually run into.
Read the post →Blog
Research and analysis
The latest security trends, threat analysis, testing methodology, and more — from the people doing the work.
111 posts
- 7 min read
CaptiveCrunch: When the Network Is the Phish
CaptiveCrunch turns the captive portal itself into the phish, and MFA does not answer it. How the chain works, and what your simulations never covered.
Read the post → - 8 min read
Healthcare Regulation Brief
The HIPAA Security Rule overhaul slipped again, and the 240-day compliance window is the part nobody reads. Where the rule stands and what it will demand.
Read the post → - 6 min read
One Phishing Test a Year Is a Compliance Artifact, Not a Security Control
One phishing simulation a year measures a single day with a single pretext. Why cadence beats the annual checkbox, and which metric is worth reporting.
Read the post → - 4 min read
AI Phishing: What to Look For When the Old Tells Are Gone
Bad grammar and generic greetings no longer identify a phishing email. The tells that still work: the ask itself, the channel, and unexplained urgency.
Read the post → - 4 min read
The First AI-Run Ransomware Attack Is Here. What It Actually Means.
Researchers documented JadePuffer, the first known ransomware attack run end to end by an AI agent. What it actually demonstrates, and what it does not.
Read the post → - 4 min read
Five Questions to Ask Before You Trust a Vendor With Your Data
Every supplier you onboard makes their security part of yours. Five questions to ask before handing over a login, an integration, or a copy of your data.
Read the post → - 3 min read
The Breach That Skips Your Wi-Fi: Why Physical Security Still Matters
Someone walks past every firewall you own because a colleague held the door. Why physical security still decides breaches, and how testing exposes it.
Read the post → - 3 min read
Can You Still Trust Your Own Eyes? A Plain Guide to Deepfakes
A video call from your boss authorising an urgent payment, except it is not her. A plain guide to deepfakes and the process changes that defeat them.
Read the post → - 6 min read
Shadow AI: The Hidden Security Risk Your Employees Are Already Creating
Your staff already use AI tools you have not approved, exactly as they once used Dropbox. What is genuinely at risk, and why blocking it does not work.
Read the post →