Threat Intelligence
Dark web monitoring services: finding credential leaks before attacks happen
Automated surveillance of hidden forums reveals stolen credentials long before attackers deploy payloads against your network.
Guides
Reference guides from the Phish Herald newsroom. They explain the ideas behind the headlines and are reviewed when the facts change.
Threat Intelligence
Tor Browser Privacy Risks: How to Neutralise Them
Default installations leak your identity through exit relay sniffing, operational habits, and local OS artifacts rather than cryptographic flaws.
Vulnerabilities
Detecting npm Package Vulnerabilities in Your Supply Chain
Most supply chain attacks bypass signature checks by exploiting legitimate dependencies, meaning you must monitor for behavioural anomalies rather than just known bad hashes.
Vulnerabilities
Patch Prioritization Logic: How to Rank Fixes by True Risk
Patch prioritisation separates urgent security fixes from routine updates by analysing exploitability and asset exposure, preventing system downtime caused by indiscriminate patching.
Vulnerabilities
Hardcoded Secrets Myths: Why Common Beliefs About Source Code Risks Are Wrong
Obfuscation does not secure secrets, and build-time injection fails when infrastructure pipelines lack strict isolation controls.
Vulnerabilities
Apache Struts Vulnerabilities: Real Questions Answered for Secure Infrastructure
Remote code execution flaws in Apache Struts often bypass perimeter defences because the framework processes malicious data before standard input validation occurs.
Vulnerabilities
VPN Appliance Vulnerabilities: 7 Mistakes That Leave You Exposed
Misconfigured split tunnelling and weak certificate validation often expose internal networks far more than the appliance software itself ever could.
Vulnerabilities
Remediation Tracking: Fixing the Six Common Misconceptions
Tracking vulnerability remediation fails when teams confuse administrative closure with actual risk reduction, leaving hidden exposures in production systems.
Vulnerabilities
iOS Zero-Click Vulnerabilities: Hidden Signs and Immediate Response Steps
Zero-click exploits bypass user interaction entirely, meaning the first sign is often anomalous system behaviour rather than a visible alert or notification.
Vulnerabilities
Detecting Cisco IOS XE Vulnerabilities: Signals, Tools and Blind Spots
Most IOS XE flaws manifest through subtle telemetry anomalies rather than obvious system crashes or immediate network outages, requiring persistent monitoring.
Vulnerabilities
IoT Device Patching: Definition, Purpose and Critical Mechanics
Firmware updates resolve low-level hardware flaws that application patches cannot touch, yet most teams ignore the supply chain risks inherent in binary blobs.
Vulnerabilities
Prevent GraphQL Vulnerabilities: Priority Controls for Your API
Default GraphQL servers expose your entire schema and allow deep nesting, turning every query into a potential denial-of-service vector before you write a single line of validation code.
Data Breaches
Backup Strategy Mistakes: 7 Errors That Cause Data Loss
Organisations lose data not because backups fail to run, but because the recovery process lacks verification and isolation from active threats.
Data Breaches
Database Exposure Prevention Checklist for Infrastructure Security
Most data leaks occur because configuration errors leave ports open, not because encryption algorithms fail or hackers break mathematical barriers.
Cloud Security
What is SaaS security: controlling risk in shared environments
SaaS security shifts responsibility from infrastructure to configuration, meaning most breaches stem from mismanaged permissions rather than software vulnerabilities.
Cloud Security
Service Mesh Security Checklist for Secure Microservices
Misconfigured sidecars often expose internal traffic to the internet, turning your service mesh into an unauthorised data exfiltration channel rather than a security boundary.
Cloud Security
Stop Exposed Storage Buckets: 3 Cloud Security Fixes That Work
Public access blocks fail when service accounts bypass user controls, making least-privilege policies the only reliable defence against accidental data exposure.
Cloud Security
Cloud Data Exfiltration: 6 Myths That Leave Your Assets Vulnerable
Most cloud data theft occurs through legitimate user accounts and standard API calls, bypassing traditional perimeter defences entirely.
Threat Intelligence
Tactics, Techniques and Procedures (TTPs) for Security Decisions
Tracking how attackers behave rather than what tools they use allows teams to detect threats that change their digital fingerprints daily.
Cloud Security
Cloud Least Privilege: Answers to 8 Critical Implementation Questions
Least privilege in the cloud fails when teams treat permissions as static assets rather than dynamic, auditable constraints that require continuous verification.
Data Breaches
Data Scraping Prevention Checklist for Web Assets
Automated bots harvest your public data faster than manual attackers, turning your own marketing content into a target for credential stuffing and social engineering.
Data Breaches
Mobile Device Management Examples: Policy, Security and Control
Mobile device management examples reveal that policy enforcement often fails when devices bridge personal and professional data without clear technical boundaries.
Malware & Ransomware
Antivirus Quarantine Explained: How Your Security Software Isolates Threats
Quarantine does not delete files; it encrypts and isolates them in a restricted folder, allowing you to recover data if the detection was a false positive.
Malware & Ransomware
Heuristic Detection for Small Business: Low Cost, High Impact
Behavioural analysis catches zero-day threats that signature databases miss, offering small teams a scalable defence against evolving malware without heavy infrastructure.