Tag
A wave of attacks on US water utilities is running through a Rockwell PLC bug with no vendor fix. The advice to "apply the patch" doesn’t apply here, and that gap explains most of what OT security gets wrong.
Quantum error correction hit a real 2026 milestone. TLS key exchange quietly went post-quantum for most web traffic already; signing keys and PKI did not, and that's the part with an actual deadline.
Three unrelated npm attacks in May and June 2026 used three different techniques. All three got past 2FA and OIDC Trusted Publishing by skipping the registry account and going straight for the CI runner.
A 2026 breach claim against Amazon's One Medical traces back through two old acquisitions. Yahoo and Marriott show why: due diligence audits what's active at close, not what gets orphaned afterward.
AI browser agents read web pages and user instructions through the same channel, so a hidden instruction in a Reddit post or calendar invite can hijack the agent. Patching the prompt won’t fix that.
Security advice for startups clusters at two useless extremes. This is a prioritised list of controls covering real breach risk, enterprise deal risk, and the AI agent security gap that most checklists miss.
Most passkey pilots succeed. Most migrations stall. Here are the three engineering problems that show up only in production B2B SaaS — and how to solve them before you're six months in.
Six controls close most of the risk surface for a 10-person SaaS: secrets out of code, MFA everywhere, dependency scanning, tenant isolation by design, access logs, and a single IdP. Most are free.
AI-generated codebases have 2.5x more critical vulnerabilities than human-written code. The useful finding: five predictable patterns that standard code review is not designed to catch.
Most security advice targets enterprises or absolute beginners. Eight controls for a 10-person B2B SaaS team — ranked by how much breach risk each closes per hour of engineering work.
Giving an LLM access to your database is easy. The problem is that your application-layer RBAC is invisible when the model generates SQL. Here's where it goes wrong and how to fix it at the layer that enforces.
Seven controls that prevent 90% of real breaches at a 10-person SaaS, ranked in the order that actually matters—not the order that looks good on a compliance questionnaire.
Practical guides, product updates, and compliance notes — straight to your inbox. No fluff.
Newsletter is opening soon. We'll switch this on once we've got our first issue ready.