Blog
Analysis and lessons from our work, without fear-mongering.
In most incidents, the avoidable damage was not caused by the attacker but by the improvised reaction of the first few hours. Five mistakes we see repeatedly, and what to do instead.
A report with twenty critical findings does not necessarily describe an insecure organization. It may describe a badly configured scanner. Six questions for judging the quality of what you were handed.