Featured article
PHP's October security fixes: what small businesses should ask their host
Your website can need a PHP update even when WordPress and its plugins are current. A practical response to the October 21 fixes and October 23 follow-up.
Security articles
Incident response, identity, cloud security, and the decisions behind the controls.
All articles
NGINX
NGINX's October updates: a small-business checklist for the website in front of your app
NGINX may sit between your customers and the application without appearing in your website dashboard. Check ownership, running versions, and the routes that matter to your business.
Certificate Security
The eMudhra CA compromise: what small businesses need to check before October 27
A certificate-authority incident can affect the software your business trusts as well as the certificate on its website. Check both before Google's announced October 27 root-store change.
FedRAMP 20x
FedRAMP 20x: the 2027 transition and what small businesses can use now
The next FedRAMP deadlines matter to cloud providers. The shift toward current, testable security evidence also offers a useful model for smaller businesses that do not sell to government.
Enterprise Risk Management
Put cyber risk in the business risk register: an ERM review using NIST 8286
A vulnerability count rarely tells an executive what to approve. Build risk entries around business disruption, accountable owners, and decisions that can be revisited.
NIST CSF 2.0
A useful NIST CSF 2.0 review starts with one business service
Use a payroll, sales, or customer-support service to connect governance, protection, detection, and recovery. Build a short current-state review that points to work your team can finish.
AI Security
AI threats in September 2026: check the access around the model
Recent AI-related security reporting points to a practical review: what can the application read, which tools can it invoke, and which credentials are exposed if something goes wrong?
NIST
NIST's draft AI reporting guide: useful assistance without invented assurance
NIST's August 2026 draft explores AI-assisted CSF analysis and reporting. Teams can use it to reduce drafting work while keeping evidence, uncertainty, and human approval visible.
Patch Management
Patch triage when attackers weaponize vulnerabilities faster than teams can patch
Build a patch queue from known exploitation, reachable systems, and business impact. Includes a worked triage example and an exception record.
AI Governance
How to govern employee AI use without blocking the business
Define usable AI approval rules around data, connectors, and business decisions, with a sample workflow record and a practical exception process.
Ransomware
Ransomware readiness after backup deletion and identity takeover
Test whether recovery still works when production identity and backup administration are untrusted, with explicit restoration and executive decision checks.
Third-Party Risk
Supplier access reviews for SaaS, MSPs, and integration-heavy environments
Review supplier accounts, OAuth grants, and service dependencies, then test how access would be removed without losing essential operations.
Social Engineering
Defending against SMS, voice, QR, and help-desk social engineering
Protect account recovery and payment approvals against cross-channel social engineering, with a help-desk scenario and concrete verification checks.
Cloud Security
The logs you need before a cloud or SaaS incident starts
Build a cloud and SaaS evidence map around actual investigation questions, with AWS and Microsoft logging caveats and a repeatable collection test.
Container Security
Container security controls that matter after deployment
Review deployed Kubernetes workloads for privilege, network reach, identity, and recoverable evidence, with a safe release-validation exercise.
Serverless Security
Serverless security for event-driven applications
Trace an event-driven application from trigger to side effect, then test authorization, duplicate delivery, permissions, and failure handling.
SMB Security
SMB Cybersecurity Essentials: A 30-Day Plan Based on CISA Guidance
A practical first-month security plan for a small team, with weekly evidence checks and a sample control register instead of a policy-writing exercise.
SMB Security
Backup Recovery for SMBs: Turning CISA's 3-2-1 Advice Into a Restore Test
Run a safe restore test that measures usable business recovery, with a worksheet for recovery time, data loss, dependencies, and owner acceptance.
SMB Security
Encrypt Business Data Without Losing Track of Keys, Backups, and Exports
Follow sensitive data through exports, devices, and backups, then check encryption coverage, authorized access, and key recovery.
Zero Trust
Zero Trust for Mid-Sized Companies Without Enterprise Bloat
Start Zero Trust with one business service, test access decisions and alternate paths, and expand only after the controls and support process work.
Incident Response
What Executives Need in the First 24 Hours of a Cyber Incident
Write an incident brief that separates confirmed facts from unknowns and gives executives a specific decision, owner, deadline, and next update.
Identity Management
Common Identity Misconfigurations in Okta and Microsoft Entra ID
Review effective sign-in policies, recovery, administrator roles, and application access in Okta and Entra ID using controlled positive and negative tests.
MFA
SMS, authenticator apps, security keys, and passkeys: choosing better MFA
Compare MFA methods by phishing resistance, recovery, and deployment needs, without treating number matching or one-time codes as phishing resistant.
Incident Response
Ransomware Tabletop Exercises That Surface Real Decision Gaps
Run a ransomware tabletop with concrete injects, evidence requirements, and follow-up tests that distinguish discussion from demonstrated response capability.
Observability
Logging Retention for Forensics Without Runaway Cost
Choose log retention by investigation need, compare searchable and archive storage, and test retrieval with a simple cost model and evidence record.
Identity Management
Identity Governance Controls That Scale Beyond Static RBAC
Improve identity lifecycle and access reviews with a mover scenario, explicit policy inputs, and verification of downstream revocation.