Posts

If the AppsFlyer script loads on your payment pages, you may have been serving malicious code. What the requirements actually ask you to do.

What the IBM X-Force Threat Intelligence Index 2026 says about AI-accelerated attacks, and why basic hygiene failures still cause the damage.

A reality check on compliance automation platforms, the gap between generated evidence and assessed controls, and the questions to ask.

AI agents are already inside your environment making decisions and calling APIs. The question is whether anyone knows what access they have.

PCI DSS v4.x wasn’t written with AI in mind. Here’s where the framework holds up, where there’s room to grow, and how the Council is engaging.

Twenty years of standards, assessor programs, and a global ecosystem. What the Council’s inaugural annual report says about where it’s heading.

AI agents call APIs, execute code, and make decisions with real consequences. The OWASP Agentic Top 10 is the first framework for that attack surface.

Stolen card data is sold at industrial scale. What the carding economy means for your PCI DSS scoping, and why many programs frame it wrong.

A threat that matured abroad has found a home in the US. How ATM jackpotting works, why it keeps working, and what the industry guidance says.

Why the cryptographic doomsday framing misleads, and what practitioners should actually be doing about post-quantum migration in 2026.