Breaches, scams and the people and processes attackers target. Sourced cases, regulation and practical defenses for security teams and ordinary users.
229 posts, newest first. Page 2 of 8.
Tags in this track:CybersecuritysecurityScamsfraudphishingsocial engineeringAccount TakeoverSIM SwapCISOcompliancePrivacyregulationsGovernance
PBKDF2 is not deprecated, but it is no longer the recommended default for new systems. Here is the honest, practical answer for developers: when PBKDF2 is still acceptable, when you should reach for Argon2id instead, and how to decide for your system.
Finding out your password was in a data leak is unsettling, but panic is not the right response and neither is ignoring it. Here is exactly what to do, in priority order, and an honest answer to how worried you should actually be.
Which is the No. 1 secure browser?" is the wrong question. Security depends on your threat model, not a leaderboard. Here is an honest comparison of Chrome, Firefox, Brave, and Safari in 2026, and how to actually choose.
When I founded LoginRadius in 2013, there was no cybersecurity-founder playbook. I wrote 11 e-books to be what I wish I had. Here's each one and the lesson it captures.
The leading CNAPP tools for 2026, compared by collection model and breadth: agentless-first platforms, broad full platforms, agent-led tools, and cloud-native specialists.
Vanta, Drata, Sprinto, Secureframe, Scytale, Thoropass, Scrut, Hyperproof, Delve, and Comp AI compared by frameworks, integrations, auditor network, and best-fit company size.
B2B SaaS founders over-buy on 8 overlapping security tool categories and miss 4 that actually matter. Here's the stage-ranked shortlist of what to evaluate.
A stranger emails saying they found a security hole in your site and would like a reward. Is it a genuine researcher, a low-effort "beg bounty," or extortion? Here is how to tell the difference and exactly what to do and not do.
Most engineers think about data storage and data processing as one technical problem. Regulators treat them as two very different things, and the gap between those views is where compliance violations quietly accumulate. Here is what the distinction actually means.
OWASP and NIST get mentioned in the same breath, but they answer different questions. One tells you what to fix in your code; the other tells you how to run a security program. Here is what each framework actually does and how to use them together.
Most best-podcasts lists are SEO-driven, not editorial. Here are the 12 cybersecurity and B2B SaaS podcasts I listen to weekly, plus the 6 I quit.
Most data breaches don't come from sophisticated zero-day attacks. They come from stolen credentials, misconfigurations, and unpatched systems. Here is a practical, prioritized playbook for preventing the breaches that actually happen.
CISA is operating at 40% capacity with 1,000 vacancies. Six threat hunters resigned in one day. The timing couldn't be worse for American cybersecurity.
A critical SQL injection in Ghost CMS turned 700+ sites into malware launchers. Harvard, Oxford, DuckDuckGo compromised. Here's what happened and what to do.
Attackers are forging authentication cookies to bypass Palo Alto GlobalProtect VPN logins. CISA KEV listed, Rapid7 confirms active exploitation since May 17.
DarkSword silently compromises iPhones through website visits alone. 270M devices affected. Apple breaks its own policy with a rare iOS 18 security backport.
FBI classifies breach of its surveillance network as a 'major incident.' Salt Typhoon suspected. Wiretap targets and investigation data potentially exposed.
Your ISP logs every site you visit through unencrypted DNS lookups. Three free tools (Cloudflare 1.1.1.1, Google 8.8.8.8, Apple Private Relay) fix most of it. Here's how each one works and what it can't do.
A founder's practical travel security checklist for 2026: realistic threats, what to actually do before, during, and after a trip, and where to skip the paranoia.
How to build a cybersecurity product roadmap that survives AI security, compliance deadlines, and threat-driven emergencies. A founder's four-lane framework.
A categorised, founder-curated list of 44 cybersecurity YouTube channels organised by what you actually want to learn: offense, defence, bug bounty, certs, careers.
A curated, categorised guide to 30 search engines that security researchers actually use: Shodan, Censys, Dehashed, ExploitDB, and the rest.
I spent ten years engineering, scaling, and defending password-based authentication for a CIAM platform that grew to a billion users.
Every headline put the 19 billion figure in 60-point type. Almost none of them mentioned that the unique entry rate is in the single digits.
Traditional marketing metrics are becoming less predictive of pipeline as buyers shift to AI-powered research.
No single organization can defend against AI-powered attacks alone. Project Glasswing's $100M consortium model may be the template for the next decade of
Cybersecurity is one of the hardest industries to market. Buyers are CISOs who can spot a generalist agency in seconds.
Mythos combined four separate low-severity bugs into a complete browser sandbox escape. Traditional scanners evaluate vulnerabilities in isolation.
Vercel breached after attacker compromised Context.ai, hijacked an employee's Google Workspace via OAuth, and accessed customer API keys and environment
Claude Mythos discovered vulnerabilities that survived 27 years of human review. This technical breakdown covers how it works, what it found, and why your
