Articles In Security

By Ken Phelan, Posted in Security

If you're like me, you've read The Art of War. Or at least you've sat through a keynote where someone put it on a slide. I'm a book geek, so I've done both. Sun Tzu has been applied to sales, chess, football, and probably your last reorg. Here's the thing. Most of it reads like common sense. Know your enemy. Know yourself. Don't pick fights you can't win. Thanks, coach. I recently came across some analysis that changed how I read it. When it was written, that kind of common sense was anything but common. ... read more.

• October 28, 2026

By Steve Gold, Posted in Security

Watch one episode of The Bear and you will notice something. The best kitchens do not just run on skill. They run on a culture where anyone can call out a problem, and that problem gets addressed instead of buried. Chef Carmen Berzatto does not want a kitchen where bad news hides. He wants a kitchen where bad news gets surfaced fast, because surfacing it is how you fix it. If your organization has no structured way to receive and act on software vulnerability reports, you are running the equivalent of a ki... read more.

• October 27, 2026

By Steve Gold, Posted in Security

Watch Andor on Disney+ and pay close attention to how Luthen Rael runs the Rebellion. He does not wing it. Every cell has defined procedures, defined limits, and defined checks. Security is not something he layers on after the operation is planned. It is built into how every mission runs from the first conversation. Your software development process should work exactly the same way. What Is Establish and Maintain a Secure Application Development Process? It means security is part of how you build software... read more.

• October 20, 2026

By Ed Bratter, Posted in Infrastructure, Security, Support

You wake up one morning, grab your coffee, and sign in to Microsoft Outlook (or any other app secured by Microsoft Entra ID). You enter your username and password, approve the usual MFA prompt, and expect to see your inbox. Instead, you get an unfamiliar screen: "Let's keep your account secure." If you're seeing this, keep reading to learn what's going on and what to do about it. For many organizations, this prompt started appearing in September 2026. It's the first phase of Microsoft's plan to retire S... read more.

• October 15, 2026

By Ken Phelan, Posted in Security

I've been reading about drones. I recommend it, in the way I'd recommend a horror movie. Here's the short version. In Ukraine right now, drones cause 70 to 80 percent of all battlefield casualties. Not artillery. Not tanks. Quadcopters. Russia claims production rates approaching seven million of them a year. Ukraine builds four million. The drone that's winning the war costs roughly a thousand dollars and kills a five-million-dollar tank. The most advanced militaries on earth spent eighty years and trillio... read more.

• October 14, 2026

By Steve Gold, Posted in Security

In John Wick: Chapter 4 (2023), the High Table does not operate on goodwill. Every obligation is written, formalized, and binding. The marker system works because the terms are explicit and non-negotiable. Nobody at the High Table closes a deal with a handshake and a smile, because a vague agreement in that world gets you killed. Your vendor contracts work the same way: if security requirements are not in writing, they do not exist. What Is Ensure Service Provider Contracts Include Security Requirements? ... read more.

• October 13, 2026

By Bert Amodol, Posted in Security

What two real incidents taught us about keeping pace with an AI-speed adversary. Three weeks ago, I wrote that your SOC isn't slow; the fight has simply gotten faster. I ended with a question: what was the first thing your team changed when AI appeared on the other side of that fight? I didn't expect my own colleagues to prove the point just days later, and in public. Within days of that post, Gotham engineers were responding to live incidents. Brian Wagner spent a week investigating the NetScaler® a... read more.

• October 13, 2026

By Pablo Vidal, Posted in Security

In my last post I wrote about how AI has changed day-to-day perimeter work: policy cleanup, onboarding new services, all the documentation around a change. This time I want to talk about the part of the job where speed matters most: the moment something looks wrong and you need to know, right now, whether it's real, how far it went, and what to block. If you read Ken Phelan's recent post, Twenty-Three Hours, you already know the story. We patched our remote-access gateways on a Saturday, and about 23 hours... read more.

• October 08, 2026

By Steve Gold, Posted in Security

In Dune: Part Two, Paul Atreides does not treat every alliance the same way. The Fremen are strategic partners with deep access to his plans and survival. The Spacing Guild controls critical infrastructure that nothing in the known universe moves without. House Corrino is a threat dressed up as diplomacy. Paul classifies each relationship by what it controls and what risk it carries, because treating them equally would get him killed. Your vendor ecosystem works exactly the same way. What Is Classify Servi... read more.

• October 06, 2026

By Brian Wagner, Posted in Security

I've always been a huge fan of Reddit. It's real people talking about real things. You follow the topics you care about and you often hear the news there before anywhere else. So on Saturday, September 26, when I started seeing chatter about an unpublished NetScaler® vulnerability, I had to dig in. The more I read, the more interested I got. Organizations were shutting down their NetScalers, and the vendor hadn't said anything yet. That evening I was at the wedding of one of my favorite people. Betwee... read more.

• October 05, 2026