Breaches, scams and the people and processes attackers target. Sourced cases, regulation and practical defenses for security teams and ordinary users.
222 posts, newest first. Page 1 of 8.
Tags in this track:Cybersecuritysecurityfraudphishingsocial engineeringCISOcompliancePrivacyregulationsGovernance
Latest in Scams & Cybersecurity
Picking an age verification vendor is the last decision, not the first. The duty you are actually under, the methods ladder, the one-bit record, and where the age claim lives in your identity model.
Read the article
ISO 42001 went from obscure standard to procurement line item in about eighteen months. It does not certify that your model is safe, and the certificate scope is where buyers consistently misread it.
More than half of BIMI records are broken and nobody got an error. Silent failure is a whole category of security control, and most of yours are in it.
Email, AI agents, media files, and build artifacts all got cryptographic verification in 2026. Same architecture, same failure modes, same mistake.
CrowdStrike clocks 29-minute breakout times and an 89% surge in AI-augmented attacks. Here is the five-phase framework I use with CISOs to close that gap, with budget splits and a board script.
Most cybersecurity vendors sell to the CISO and lose the deal to a security engineer they never spoke to. Security purchases are committee decisions with an asymmetric structure: many people can kill a deal, few can approve one. Here is how it actually works.
CVE, CWE, CAPEC, ATT&CK, CVSS, KEV, ATLAS. The security taxonomy acronyms get used interchangeably and they should not be. Here is what each one actually does, how they chain together, and why they matter more for your content strategy than most security marketers realize.
Three RFPs out, three decks back, cheapest bid wins, and six months later you are over budget. The problem is the selection process, not the firms.
An enterprise prospect just asked for your SOC 2. Here is what the report really is, Type I vs Type II, the ten policies auditors expect, and how Vanta and Drata changed the work.
On System Administrator Appreciation Day, appreciation for the people who hold the literal keys to the organization, and why identity work matters more, not less, in the AI era.
Both are free, fast, and encrypted. The real differences are what they block, what they log, and whose laws govern the servers.
ShinyHunters claimed 2.2M Kodak records with a June 18 leak deadline. The group has breached Snowflake, Salesforce, Canvas, PeopleSoft, and now Kodak.
One phished BPO agent extracted 13M Adobe customer records and unpublished vulnerability reports from HackerOne. Third-party access is the breach pattern of 2026.
Iranian hackers wiped tens of thousands of Stryker devices in one attack. No data stolen. Just destruction. A new phase in state-sponsored cyber warfare.
Novo Nordisk confirmed a June 2026 data breach. The pharmaceutical giant behind Ozempic becomes the latest healthcare target in an accelerating trend.
74,000 Fortinet admin credentials cracked by GPU clusters from config backups stolen via old vulnerabilities. Patching the device wasn't enough.
ShinyHunters breached Canvas LMS through a free teacher account flaw. Instructure paid the ransom. Data was already copied. 275M student records exposed.
France banned Signal for government use and built Tchap. A hacker stole 73K accounts, 643K messages, and 59K media files from French ministry conversations.
24 billion stolen credentials in one database. 8.3TB of plaintext passwords and login URLs harvested by infostealers. The credential economy has scaled.
ShinyHunters weaponized a PeopleSoft zero-day to breach 100+ organizations in two weeks. 455K student records at Nottingham alone. Oracle's advisory came last.
ServiceNow shipped a REST endpoint with authentication disabled. Attackers queried customer data without credentials. The company knew since April.
Traditional vulnerability cycles take months from discovery to patch. AI compresses that to hours. CrowdStrike reports 29-minute breakout times and 89% more AI-augmented attacks year-over-year.
Security leaders face over 10,000 alerts a day. Here is how to build a personalized cybersecurity news feed that filters the noise and surfaces the threats that matter to your organization.
Every few months another tech giant is fined hundreds of millions for violating your privacy. The numbers are enormous, the violations keep accelerating, and the math explains why: the penalties cost far less than compliance. Here is what they really mean, and what you can actually do.
PBKDF2 is not deprecated, but it is no longer the recommended default for new systems. Here is the honest, practical answer for developers: when PBKDF2 is still acceptable, when you should reach for Argon2id instead, and how to decide for your system.
Finding out your password was in a data leak is unsettling, but panic is not the right response and neither is ignoring it. Here is exactly what to do, in priority order, and an honest answer to how worried you should actually be.
Which is the No. 1 secure browser?" is the wrong question. Security depends on your threat model, not a leaderboard. Here is an honest comparison of Chrome, Firefox, Brave, and Safari in 2026, and how to actually choose.
When I founded LoginRadius in 2013, there was no cybersecurity-founder playbook. I wrote 11 e-books to be what I wish I had. Here's each one and the lesson it captures.
The leading CNAPP tools for 2026, compared by collection model and breadth: agentless-first platforms, broad full platforms, agent-led tools, and cloud-native specialists.
Vanta, Drata, Sprinto, Secureframe, Scytale, Thoropass, Scrut, Hyperproof, Delve, and Comp AI compared by frameworks, integrations, auditor network, and best-fit company size.
B2B SaaS founders over-buy on 8 overlapping security tool categories and miss 4 that actually matter. Here's the stage-ranked shortlist of what to evaluate.
New writing on identity, AI security, and building software, delivered when it ships. No tracking pixels, no funnels, unsubscribe with one click.
