Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
CISA Update A revises critical guidance for Johnson Controls C-CURE 9000 and victor. Review CVE-2026-21655, adjacent-network exposure on port 8999, affected versions, fixed releases, and temporary mitigations.
Read the briefing
Microsoft has fixed CVE-2026-70329, an Outlook integer-overflow vulnerability rated CVSS 8.8. Exploitation requires a user to open a malicious Office file. Review the exact affected editions, deploy the August 11 security release, and verify the installed build by servicing channel.
Read the briefing
Microsoft reports active exploitation of CVE-2026-68820, a Windows privilege-escalation flaw that can grant SYSTEM access. Inventory affected systems, deploy the applicable August update, and verify the result with evidence.
Read the briefing
Beginning September 1, 2026, Microsoft will start auto-enabling passkeys and registration nudges for SMS- and voice-enabled users in public-cloud Microsoft Entra ID tenants. On February 1, 2027, Microsoft-provided SMS and voice delivery ends; organizations must migrate affected users to a phishing-resistant method or configure a customer-managed telecom provider.
Read the briefing
Information remains exposed before, during, and after an exchange—regardless of whether it moves through an API, portal, file transfer, email, shared database, or manual process. Put protection duties and exit conditions in an owned agreement.
Read the playbook
The most expensive asset is not always the component whose loss matters most. Trace organizational goals through programs, systems, functions, and components so protection, acquisition, maintenance, and recovery follow operational consequence.
Read the guide
Threat and incident information loses value when recipients cannot tell who may receive it. Use the four TLP 2.0 labels consistently, keep the source’s marking intact, and add separate handling instructions when TLP does not answer the need.
Read the guide
Cloud investigators depend on provider capabilities, customer configuration, jurisdiction, interfaces, time, and retention that cannot be improvised after an incident. Map evidence needs to cloud capabilities and mitigate gaps before collection becomes urgent.
Read the playbook
A useful penetration test can also interrupt services, expose data, or resemble a real attack. Written rules of engagement turn scope, permission, safety boundaries, communications, evidence handling, and stop authority into testable controls.
Read the checklist
Identity proofing establishes which real-world person is being enrolled; authentication later proves control of an authenticator. Select the needed assurance, protect proofing data, offer workable paths, and build redress for mistakes and fraud.
Read the guide