4 min read
Your Insider Threat Model Now Has a Folder Called Saudi Gov Docs
A former OpenAI engineer allegedly worked for a foreign government. Whether the charges stick or not, the scenario is no longer hypothetical—and…
Blog
3 min read
Ransomware Gangs Are Walking Through PAN-OS CVE-2026-0257—Patch Tonight
Unit 42 confirmed October 19 that two ransomware operations are using a PAN-OS vulnerability for initial access to enterprise networks. If your…
7 min read
Microsoft Retires Search-UnifiedAuditLog in 12 Months—Here’s What Broke When I Migrated
Every compliance audit, security incident, and insider threat investigation uses one PowerShell cmdlet to pull M365's unified audit log. That cmdlet goes…
4 min read
Stolen Passwords Are Boring. Stolen Consent Just Owned 173 Tenants at Once.
The ConnectWise breach didn't steal a password—it weaponized 173 consent grants that customer tenants had already approved. One stolen app credential became…
6 min read
I Gave an Agent a Service Principal. Token Lifetime Is the Revocation Problem.
Microsoft's Project Perception promises to monitor AI agents at machine speed. But when I rotated credentials mid-week, the already-issued token kept working…
4 min read
The Vendor API Was Your Security Boundary. With Open Weights, You Inherit It.
When you download a LLaMA or Mistral checkpoint onto your own infrastructure, the weights become your asset to secure. Here's how to…
4 min read
27, 9, 6: The Three Numbers Behind Anthropic’s Vanishing Junior Hires
Anthropic's junior share of technical hiring fell from 27% to 9% in eighteen months while internal agents logged six times the hours…
4 min read
Your SiteGuard WAF now executes attacker commands as root — the checklist
An unauthenticated command injection flaw in SiteGuard Server Edition lets attackers execute arbitrary code as root on Linux or SYSTEM on Windows.…
8 min read
Three Things That Break When a Purview Admin Leaves and Nobody Cleans Up
Purview role groups store references to users, not live lookups. Delete someone in Entra ID and the role assignment persists as "Unknown"—invisible…
7 min read
RFC 8693 Is the Only Token Swap You Can Take With You When You Switch Vendors
Your middle-tier API has a user token and needs to call a downstream service as that user. On-Behalf-Of is the pattern. RFC…