Blog
News, opinion and deep dives from the front line of security operations.
AI Driven Security Operations
Seven Minutes, 100 Storage Accounts: What Agentic Attackers Mean For Your SOC
Storm-3168 deleted Azure storage in seven minutes after 15 hours of recon. The window that matters is the recon, and most SOCs aren't watching it.
Threat Research
Exchange Server CVE-2026-96940: Patch The Mailbox-Read Flaw Before It's Weaponised
An out-of-band fix for on-prem Exchange closes a flaw that lets one compromised user read other mailboxes. Who must act, and how to hunt for it.
Threat Research
Microsoft Digital Defense Report 2026: Reading It Against Your Own Detections
Microsoft's 2026 report names the techniques. The harder question is whether your own detections would see any of them. How to read it as a work list.
SIEM
The Difference Between SIEM and Log Management
Every SIEM contains a log manager. No log manager contains a SIEM. What each one is for, why the distinction gets blurred, and which you actually need.
Offensive Security
Warshipping: How Businesses Are Getting Hacked Through the Post
A cheap wireless implant, posted in a parcel, sitting in your mailroom. What warshipping is, why the mailroom is the gap, and what actually stops it.
SIEM
Best SIEM Tools in 2022 — And What Has Changed Since
Most of the 2022 SIEM shortlist has since been acquired, merged or absorbed. What actually changed, what did not, and how to choose one now.
Threat Research
Brevo Supply Chain Attack: One API Key, 100,000 Websites
A hardcoded Cloudflare API key let attackers rewrite Brevo's scripts at the edge, pushing ClickFix and a hidden WordPress backdoor to around 100,000 sites.
SIEM
Microsoft Sentinel vs Splunk
Microsoft Sentinel vs Splunk — two capable SIEMs with different shapes. How each is built, how each is charged, and the question that actually decides it.
Threat Research
Plugin4Shell: A Zero-Click RCE In Four AI Coding Agents
Four AI coding agents checked out a pinned commit without verifying it landed. A branch named like the hash delivers malicious code, and the pin still looks intact.
Threat Research
Crystal PDF Malicious Installer Campaign
A fake PDF editor pushed through Google Ads and SEO poisoning, stealing browser credentials and session tokens. Full IOCs, a KQL hunting query, and how to respond.
Threat Research
WhatsApp Android Zero-Click Media Exploit
A Project Zero disclosure showing how group trust and automatic media download combine to place attacker-controlled files on an Android device with no interaction at all.
Threat Research
Hunting For CVE-2025-59287 Exploitation In Windows Server Update Services (WSUS)
CVE-2025-59287 is a critical deserialisation flaw in WSUS. How exploitation looks in practice, and how to hunt for it with behavioural indicators rather than static signatures.
Threat Research
CVE-2025-55241 – Azure Entra Elevation Of Privilege Via Actor Token Vulnerability
A flaw in Entra ID meant any user account could be escalated to Global Administrator. Patched before disclosure — and still the most instructive Entra bug of the year.
Threat Research
ToolShell Exploits: Inside CVE-2025-53770 And CVE-2025-53771's Critical Threat To SharePoint
Two chained SharePoint flaws giving unauthenticated remote code execution — and both are patch bypasses. Affected versions, attacker tradecraft, IOCs and what to do now.
Threat Research
From ClickFix To FileFix: A New Frontier In Social Engineering Attacks
ClickFix persuaded users to run commands themselves. FileFix does the same through File Explorer — no download, no Mark-of-the-Web, and almost nothing to distinguish it from normal work.
Threat Research
Massive Password Leak: Investigating The Alleged 16 Billion Credential Breach
Headlines claimed the largest credential compilation in history. Our threat intelligence team investigated, and the reality is less dramatic and more persistent than the number suggests.
Threat Research
Dumping System Secrets While EDR Is Running
Blocking the obvious tool is not the same as preventing the technique. Why SAM, SYSTEM and SECURITY remain reachable with EDR running, and what actually detects it.
Threat Research
Weaponizing Screen Savers: A Deep Dive Into SCR File Exploitation
A .scr file is nominally a screen saver and actually a Windows executable. Why that distinction is an attack vector, why detection struggles with it, and how to shut it down.
Governance
What Is GRC in Cyber Security?
What GRC in cyber security means — governance, risk management and compliance — why it matters, and how to implement it without stalling the organisation.
Threat Research
COM Hijacking: Enhancing Red Team Persistence Strategies
A fileless persistence technique that needs no admin rights and leaves almost no forensic trace. How COM hijacking works, why it is hard to see, and the registry telemetry that catches it.
Fundamentals
Unlocking the Secrets of Steganography in Cyber Security
Steganography hides the existence of a message rather than its contents. The five types, how defenders and attackers both use it, and how to detect it.
Threat Research
Escaping a Docker Container: An Attacker's Perspective
A container is not a security boundary by default. How an over-privileged container becomes a host compromise, which capabilities actually matter, and how to detect and prevent it.
Fundamentals
What Is Spooling in Cyber Security? Meaning and How to Combat It
What spooling means in cyber security, why printers and other spooling devices are an easy target, and the practical steps that stop a spooling attack.
Offensive Security
Top 7 Hacking Products By Hak5 — Remote Access, WiFi, & MITM Attacks
The top hacking tools from Hak5 as rated by us, what they do, and how they can help detect security vulnerabilities in your business.
Fundamentals
5 Ways Hackers Can Bypass Two-Factor Authentication
2FA is a real improvement on a password alone — and attackers have adapted to it. The five routes around it that we see in practice, and what actually closes them.
Nothing matches that.