Posts

At least 11 phishing kits now abuse the OAuth device flow to bypass MFA entirely. How the attack works and how to shut it down.

Every consumer router made outside the US is now on the FCC Covered List. Why firmware verification matters more than the import ban.

Two weeks after writing about the structural problems with compliance platforms, the allegations landed. What assessors already knew.

What to watch at RSAC 2026, filtered for practitioners: the agentic AI themes with substance and the ones that are vendor noise.

If your IAM program doesn’t treat non-human identities with the same rigor as human accounts, you have a problem that’s already being exploited.

If the AppsFlyer script loads on your payment pages, you may have been serving malicious code. What the requirements actually ask you to do.

What the IBM X-Force Threat Intelligence Index 2026 says about AI-accelerated attacks, and why basic hygiene failures still cause the damage.

A reality check on compliance automation platforms, the gap between generated evidence and assessed controls, and the questions to ask.

AI agents are already inside your environment making decisions and calling APIs. The question is whether anyone knows what access they have.

PCI DSS v4.x wasn’t written with AI in mind. Here’s where the framework holds up, where there’s room to grow, and how the Council is engaging.