Series
Front Line
15 articles, in order.
What an alert actually costs you before anyone looks at it
The expensive part of an alert is not the investigation. It is the forty minutes it waits in a queue while nobody knows whether it matters.
MFA Gaps: Why So Many Breaches Still Start With a Password
MFA gaps let attackers into Colonial Pipeline, Change Healthcare and Snowflake customers. Why an MFA policy isn't MFA coverage, and how to find every gap.
Alert Fatigue: What It Costs Your Security Team and How to Fix It
Alert fatigue costs security teams missed threats, wasted time and burnout. Learn where the cost comes from and practical steps to reduce alert fatigue.
Attacker Dwell Time: How Long Do Intruders Go Undetected?
Attacker dwell time is how long intruders go unnoticed. Mandiant's latest median, seven real breach timelines, and how to cut the time from signal to response.
ConnectWise Breach: Why Microsoft 365 App Permissions Matter
The ConnectWise Cloud Backup compromise reached Microsoft 365 tenants through already-trusted apps, at machine speed. What happened and what to check now.
Five Security Controls That Would Have Changed 15 Breaches
Five security controls would have changed fifteen major breaches, from Target and Equifax to MOVEit and Change Healthcare. Can you prove yours work today?
PHP2Shell: patched isn't safe until you check for compromise
PHP2Shell was exploited before the 21 October fix. How to find every PHP install and check for signs of compromise, not just confirm the patch.
Node2Shell: is the Brotli flaw hiding in your Node.js?
Node2Shell (CVE-2026-111497) is a critical Brotli flaw inside Node.js, now actively exploited. How to find exposed systems, patch, and spot attack attempts.
ESXi logging flaw CVE-2026-41709: when your audit trail goes quiet
CVE-2026-41709, a 'low' VMware ESXi logging flaw, was used as a zero-day to hide attackers' tracks. Why the score misled, and what to patch and check now.
Compromised developer laptops: lessons from the Binance hack
The $6.3bn Binance hack may have started with a compromised developer laptop. What happened, why engineers' devices matter, and what to check now.
Ivanti Connect Secure zero-days: why you need to patch again
Ivanti Connect Secure zero-days gave attackers root on fully patched VPNs. Why the October fix isn't enough, what attackers took, and what to do now.
NCSC State of the Cyber Nation 2026: what AI attacks mean for you
The NCSC State of the Cyber Nation report warns of AI-powered ransomware on UK infrastructure by 2028. What it says and the steps to take now.
Supermarket fridge cyber attacks: lock down exposed controllers
The supermarket fridge cyber attacks hit stores across Europe and UK food suppliers through exposed, unpatched controllers. What happened and what to check now.
When the security update is the attack: OpsShield's cPGuard supply chain breach
Attackers hijacked OpsShield's cPGuard update channel for ~70 minutes, hitting ~2,950 Linux servers as root. What SOCs and hosts should do now.
Barracuda ESG: two flaws chain to unauthenticated root
Two Barracuda ESG flaws can be chained for root without a login if Admin UI is reachable. What the CVEs do, who is affected, and what to patch.