Incident Response

BOD 26-04 in Practice: What the Three-Day KEV Tier Actually Requires

14 August 2026·1196 words·6 mins

Vulnerability Management CISA BOD 26-04 KEV Catalog CI/CD Security Incident Response Threat Hunting

Two August KEV additions put CISA’s most aggressive remediation tier into practice for the first time. The operational shift isn’t the calendar, it’s the requirement to determine whether an attacker got there first.

Your Private APN Is a Flat Network You Never Threat Modeled

12 August 2026·1405 words·7 mins

Operational Technology Threat Intelligence Private APN Cellular Routers Network Segmentation PLC Security Incident Response Asset Inventory

A three month investigation into a December 2025 attack on a Polish combined heat and power plant found something no one had documented before: attackers reaching an operational technology network through a private cellular APN. There was no exploited CVE and no malware. Every destructive step used a supported device function.

When the Negotiator Is on Both Sides of the Table: Rethinking IR Trust After the BlackCat Sentencings

1 May 2026·1822 words·9 mins

Security Operations Incident Response Insider Threat Ransomware Third-Party Risk

The BlackCat sentencings expose the trust every organization quietly extends to its incident response vendor, and how to structure it better.

FIRESTARTER and the Detection Gap CISA Just Made Official

28 April 2026·1417 words·7 mins

Threat Research Detection Engineering Threat Intelligence Network Security Incident Response

CISA and NCSC published a joint analysis of FIRESTARTER, a backdoor that survives reboots and evades signature detection on Cisco edge devices.

↑