Most organizations know which systems need to be publicly accessible. A website, VPN, customer portal or another business service usually has a clear reason for being reachable from the internet. The bigger problem can be systems that nobody remembers are still accessible. Infrastructure changes over time. A new server is deployed, a supplier is given […]

You have an external IT provider maintaining your computers, user accounts, network, backups and day-to-day support. When something stops working, you know who to call, employees have the access they need and systems generally work as expected. It is therefore understandable to assume that security is covered as well. However, IT maintenance and an independent […]

When an organization starts looking more closely at how ready it really is for NIS2, the initial picture often looks quite good. There is a firewall, backups run regularly, MFA is enabled, employees receive security training, and everyone knows who to call if an incident occurs. Most of these measures were not introduced because of […]

One of the first questions during an ISO 27001 GAP analysis is often whether a particular policy or procedure exists. The document exists, has been approved, has an owner, a version number, and a date of last review. It states that user access is reviewed regularly, security incidents are recorded, backups are tested, and access […]

If you ask most organizations today how they protect themselves from ransomware, you will often hear the same answer. “We have backups.” A few years ago, that was enough in many cases. Attackers encrypted the servers, the organization restored its data from backup, and business continued. Today, things are different. Ransomware groups have long realized […]

Many organizations believe they are protected from ransomware simply because they have backups. On paper, that sounds reasonable. Backup jobs run, storage exists, retention is configured, and every morning someone sees the green status that everything completed successfully. That usually creates a sense of security. Until something actually happens. The problem is that backup and […]

Modern applications and digital products go through more validation than ever before. Code reviews are a standard part of development, automated security checks are often integrated into deployment pipelines, and both functional and security testing are now common parts of the release process. And yet, products that pass these checks still end up compromised. The […]

In most cases, an attack does not start with exploiting a system. It does not begin with complex tooling or advanced techniques. It starts with access. Most often through a user account that appears completely legitimate. The reason is simple. User accounts remain one of the easiest entry points. A reused password, a convincing phishing […]

Many clients still assume they have completed a penetration test simply because they received a security report with a list of findings. In most cases, what they actually have is a vulnerability scan. At a glance, both approaches look similar. Both produce reports, list issues, and include recommendations. But they do not answer the same […]

When organizations begin preparing for NIS2, the first instinct is often to understand the Directive itself. Many teams start by reading legal articles and trying to interpret what each paragraph requires. That approach rarely leads to clarity. NIS2 is not primarily a legal exercise. It is a governance and risk management framework that pushes organizations […]

Penetration testing is often treated as a form of reassurance. The engagement is commissioned, the test is completed, and the final expectation is simple – confirmation that everything is under control. When the report contains no critical findings, the outcome is usually interpreted as success. In real-world environments, however, this conclusion is often misleading. A […]

The period between Christmas and New Year usually brings slower business operations, reduced staffing, and a focus on keeping only essential processes running. For attackers, this is not downtime. It is an opportunity. Security incidents that begin during the holidays are often not detected immediately, and their full impact becomes visible only after normal operations […]